Skip to content

Commit 0ac7da6

Browse files
ConstellationConstellation
committed
[JSC] Strictly annotate pointers with TrustedImmPtr in CCallHelpers
https://bugs.webkit.org/show_bug.cgi?id=238827 Reviewed by Mark Lam. This allows us to detect pointer use in DFG easy. This is important in unlinked DFG development. We also consistently use m_graph instead of m_jit.graph() in DFG::SpeculativeJIT. We also purge CodeBlock* embedding in DFG code completely. Now we load it from the cfr instead (compileLogShadowChickenTail and callOperationWithCallFrameRollbackOnException). * dfg/DFGArrayifySlowPathGenerator.h: * dfg/DFGCallArrayAllocatorSlowPathGenerator.h: * dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h: * dfg/DFGJITCompiler.cpp: (JSC::DFG::JITCompiler::compile): (JSC::DFG::JITCompiler::compileFunction): * dfg/DFGOSRExit.cpp: (JSC::DFG::OSRExit::OSRExit): (JSC::DFG::OSRExit::compileExit): * dfg/DFGOSRExitCompilerCommon.cpp: (JSC::DFG::osrWriteBarrier): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::SpeculativeJIT): (JSC::DFG::SpeculativeJIT::emitGetCallee): (JSC::DFG::SpeculativeJIT::emitOSRExitFuzzCheck): (JSC::DFG::SpeculativeJIT::speculationCheck): (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR): (JSC::DFG::SpeculativeJIT::checkArray): (JSC::DFG::SpeculativeJIT::useChildren): (JSC::DFG::SpeculativeJIT::compileGetById): (JSC::DFG::SpeculativeJIT::compileGetByIdFlush): (JSC::DFG::SpeculativeJIT::compileDeleteById): (JSC::DFG::SpeculativeJIT::compileDeleteByVal): (JSC::DFG::SpeculativeJIT::compileInById): (JSC::DFG::SpeculativeJIT::compileInByVal): (JSC::DFG::SpeculativeJIT::compileHasPrivate): (JSC::DFG::SpeculativeJIT::compileStringSlice): (JSC::DFG::SpeculativeJIT::compileLoopHint): (JSC::DFG::SpeculativeJIT::compileCurrentBlock): (JSC::DFG::SpeculativeJIT::checkArgumentTypes): (JSC::DFG::SpeculativeJIT::compile): (JSC::DFG::SpeculativeJIT::createOSREntries): (JSC::DFG::SpeculativeJIT::linkOSREntries): (JSC::DFG::SpeculativeJIT::compileCheckTraps): (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal): (JSC::DFG::SpeculativeJIT::compileDoublePutByVal): (JSC::DFG::SpeculativeJIT::compilePutByVal): (JSC::DFG::SpeculativeJIT::compileGetByValOnString): (JSC::DFG::compileClampDoubleToByte): (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds): (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): * dfg/DFGSpeculativeJIT.h: (JSC::DFG::SpeculativeJIT::nextBlock): (JSC::DFG::SpeculativeJIT::masqueradesAsUndefinedWatchpointIsStillValid): (JSC::DFG::SpeculativeJIT::identifierUID): (JSC::DFG::SpeculativeJIT::callOperationWithCallFrameRollbackOnException): * dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::cachedGetById): (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis): (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined): (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined): (JSC::DFG::SpeculativeJIT::emitCall): (JSC::DFG::SpeculativeJIT::compileToBooleanObjectOrOther): (JSC::DFG::SpeculativeJIT::compileToBoolean): (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch): (JSC::DFG::SpeculativeJIT::emitBranch): (JSC::DFG::SpeculativeJIT::compileGetByVal): (JSC::DFG::SpeculativeJIT::compile): (JSC::DFG::SpeculativeJIT::compileArithRandom): * dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::fillJSValue): (JSC::DFG::SpeculativeJIT::cachedGetById): (JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis): (JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined): (JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined): (JSC::DFG::SpeculativeJIT::emitCall): (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal): (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict): (JSC::DFG::SpeculativeJIT::fillSpeculateInt52): (JSC::DFG::SpeculativeJIT::fillSpeculateDouble): (JSC::DFG::SpeculativeJIT::fillSpeculateCell): (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean): (JSC::DFG::SpeculativeJIT::fillSpeculateBigInt32): (JSC::DFG::SpeculativeJIT::compileCompareEqPtr): (JSC::DFG::SpeculativeJIT::compileToBooleanObjectOrOther): (JSC::DFG::SpeculativeJIT::compileToBoolean): (JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch): (JSC::DFG::SpeculativeJIT::emitUntypedBranch): (JSC::DFG::SpeculativeJIT::emitBranch): (JSC::DFG::SpeculativeJIT::compileGetByVal): (JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithInt52Size): (JSC::DFG::SpeculativeJIT::compile): (JSC::DFG::SpeculativeJIT::compileArithRandom): (JSC::DFG::SpeculativeJIT::compileDateGet): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC): (JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC): (JSC::FTL::DFG::LowerDFGToB3::getPrivateName): (JSC::FTL::DFG::LowerDFGToB3::compilePrivateBrandAccess): (JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName): (JSC::FTL::DFG::LowerDFGToB3::cachedPutById): (JSC::FTL::DFG::LowerDFGToB3::compileGetByValImpl): (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal): (JSC::FTL::DFG::LowerDFGToB3::compileDelBy): (JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation): (JSC::FTL::DFG::LowerDFGToB3::compileNewFunction): (JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments): (JSC::FTL::DFG::LowerDFGToB3::compileObjectKeysOrObjectGetOwnPropertyNames): (JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject): (JSC::FTL::DFG::LowerDFGToB3::emitNewTypedArrayWithSize): (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope): (JSC::FTL::DFG::LowerDFGToB3::compileNotifyWrite): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * ftl/FTLOSRExitCompiler.cpp: (JSC::FTL::compileStub): * jit/CCallHelpers.cpp: * jit/CCallHelpers.h: (JSC::CCallHelpers::std::is_pointer<CURRENT_ARGUMENT_TYPE>::value): Deleted. * jit/JIT.cpp: (JSC::JIT::emitEnterOptimizationCheck): * jit/JITArithmetic.cpp: (JSC::JIT::emitMathICFast): (JSC::JIT::emitMathICSlow): * jit/JITOpcodes.cpp: (JSC::JIT::emitSlow_op_new_object): (JSC::JIT::emit_op_catch): (JSC::JIT::emit_op_switch_imm): (JSC::JIT::op_enter_handlerGenerator): (JSC::JIT::emit_op_debug): (JSC::JIT::emitSlow_op_loop_hint): (JSC::JIT::emit_op_new_regexp): (JSC::JIT::emitNewFuncCommon): (JSC::JIT::emitNewFuncExprCommon): (JSC::JIT::emit_op_profile_type): * jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_put_getter_by_id): (JSC::JIT::emit_op_put_setter_by_id): (JSC::JIT::emit_op_put_getter_setter_by_id): (JSC::JIT::emitWriteBarrier): * wasm/js/WasmToJS.cpp: (JSC::Wasm::wasmToJS): Canonical link: https://commits.webkit.org/249296@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@292445 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent 7a58e66 commit 0ac7da6

20 files changed

Lines changed: 662 additions & 522 deletions

‎Source/JavaScriptCore/ChangeLog‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,148 @@
1+
2022-04-05 Yusuke Suzuki <ysuzuki@apple.com>
2+
3+
[JSC] Strictly annotate pointers with TrustedImmPtr in CCallHelpers
4+
https://bugs.webkit.org/show_bug.cgi?id=238827
5+
6+
Reviewed by Mark Lam.
7+
8+
This allows us to detect pointer use in DFG easy. This is important in unlinked DFG development.
9+
We also consistently use m_graph instead of m_jit.graph() in DFG::SpeculativeJIT.
10+
11+
We also purge CodeBlock* embedding in DFG code completely. Now we load it from the cfr
12+
instead (compileLogShadowChickenTail and callOperationWithCallFrameRollbackOnException).
13+
14+
* dfg/DFGArrayifySlowPathGenerator.h:
15+
* dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
16+
* dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h:
17+
* dfg/DFGJITCompiler.cpp:
18+
(JSC::DFG::JITCompiler::compile):
19+
(JSC::DFG::JITCompiler::compileFunction):
20+
* dfg/DFGOSRExit.cpp:
21+
(JSC::DFG::OSRExit::OSRExit):
22+
(JSC::DFG::OSRExit::compileExit):
23+
* dfg/DFGOSRExitCompilerCommon.cpp:
24+
(JSC::DFG::osrWriteBarrier):
25+
* dfg/DFGSpeculativeJIT.cpp:
26+
(JSC::DFG::SpeculativeJIT::SpeculativeJIT):
27+
(JSC::DFG::SpeculativeJIT::emitGetCallee):
28+
(JSC::DFG::SpeculativeJIT::emitOSRExitFuzzCheck):
29+
(JSC::DFG::SpeculativeJIT::speculationCheck):
30+
(JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
31+
(JSC::DFG::SpeculativeJIT::checkArray):
32+
(JSC::DFG::SpeculativeJIT::useChildren):
33+
(JSC::DFG::SpeculativeJIT::compileGetById):
34+
(JSC::DFG::SpeculativeJIT::compileGetByIdFlush):
35+
(JSC::DFG::SpeculativeJIT::compileDeleteById):
36+
(JSC::DFG::SpeculativeJIT::compileDeleteByVal):
37+
(JSC::DFG::SpeculativeJIT::compileInById):
38+
(JSC::DFG::SpeculativeJIT::compileInByVal):
39+
(JSC::DFG::SpeculativeJIT::compileHasPrivate):
40+
(JSC::DFG::SpeculativeJIT::compileStringSlice):
41+
(JSC::DFG::SpeculativeJIT::compileLoopHint):
42+
(JSC::DFG::SpeculativeJIT::compileCurrentBlock):
43+
(JSC::DFG::SpeculativeJIT::checkArgumentTypes):
44+
(JSC::DFG::SpeculativeJIT::compile):
45+
(JSC::DFG::SpeculativeJIT::createOSREntries):
46+
(JSC::DFG::SpeculativeJIT::linkOSREntries):
47+
(JSC::DFG::SpeculativeJIT::compileCheckTraps):
48+
(JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):
49+
(JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
50+
(JSC::DFG::SpeculativeJIT::compilePutByVal):
51+
(JSC::DFG::SpeculativeJIT::compileGetByValOnString):
52+
(JSC::DFG::compileClampDoubleToByte):
53+
(JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):
54+
(JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
55+
* dfg/DFGSpeculativeJIT.h:
56+
(JSC::DFG::SpeculativeJIT::nextBlock):
57+
(JSC::DFG::SpeculativeJIT::masqueradesAsUndefinedWatchpointIsStillValid):
58+
(JSC::DFG::SpeculativeJIT::identifierUID):
59+
(JSC::DFG::SpeculativeJIT::callOperationWithCallFrameRollbackOnException):
60+
* dfg/DFGSpeculativeJIT32_64.cpp:
61+
(JSC::DFG::SpeculativeJIT::cachedGetById):
62+
(JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
63+
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined):
64+
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined):
65+
(JSC::DFG::SpeculativeJIT::emitCall):
66+
(JSC::DFG::SpeculativeJIT::compileToBooleanObjectOrOther):
67+
(JSC::DFG::SpeculativeJIT::compileToBoolean):
68+
(JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
69+
(JSC::DFG::SpeculativeJIT::emitBranch):
70+
(JSC::DFG::SpeculativeJIT::compileGetByVal):
71+
(JSC::DFG::SpeculativeJIT::compile):
72+
(JSC::DFG::SpeculativeJIT::compileArithRandom):
73+
* dfg/DFGSpeculativeJIT64.cpp:
74+
(JSC::DFG::SpeculativeJIT::fillJSValue):
75+
(JSC::DFG::SpeculativeJIT::cachedGetById):
76+
(JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):
77+
(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined):
78+
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined):
79+
(JSC::DFG::SpeculativeJIT::emitCall):
80+
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
81+
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
82+
(JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
83+
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
84+
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
85+
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
86+
(JSC::DFG::SpeculativeJIT::fillSpeculateBigInt32):
87+
(JSC::DFG::SpeculativeJIT::compileCompareEqPtr):
88+
(JSC::DFG::SpeculativeJIT::compileToBooleanObjectOrOther):
89+
(JSC::DFG::SpeculativeJIT::compileToBoolean):
90+
(JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):
91+
(JSC::DFG::SpeculativeJIT::emitUntypedBranch):
92+
(JSC::DFG::SpeculativeJIT::emitBranch):
93+
(JSC::DFG::SpeculativeJIT::compileGetByVal):
94+
(JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithInt52Size):
95+
(JSC::DFG::SpeculativeJIT::compile):
96+
(JSC::DFG::SpeculativeJIT::compileArithRandom):
97+
(JSC::DFG::SpeculativeJIT::compileDateGet):
98+
* ftl/FTLLowerDFGToB3.cpp:
99+
(JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC):
100+
(JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
101+
(JSC::FTL::DFG::LowerDFGToB3::getPrivateName):
102+
(JSC::FTL::DFG::LowerDFGToB3::compilePrivateBrandAccess):
103+
(JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName):
104+
(JSC::FTL::DFG::LowerDFGToB3::cachedPutById):
105+
(JSC::FTL::DFG::LowerDFGToB3::compileGetByValImpl):
106+
(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
107+
(JSC::FTL::DFG::LowerDFGToB3::compileDelBy):
108+
(JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
109+
(JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
110+
(JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
111+
(JSC::FTL::DFG::LowerDFGToB3::compileObjectKeysOrObjectGetOwnPropertyNames):
112+
(JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject):
113+
(JSC::FTL::DFG::LowerDFGToB3::emitNewTypedArrayWithSize):
114+
(JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
115+
(JSC::FTL::DFG::LowerDFGToB3::compileNotifyWrite):
116+
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
117+
* ftl/FTLOSRExitCompiler.cpp:
118+
(JSC::FTL::compileStub):
119+
* jit/CCallHelpers.cpp:
120+
* jit/CCallHelpers.h:
121+
(JSC::CCallHelpers::std::is_pointer<CURRENT_ARGUMENT_TYPE>::value): Deleted.
122+
* jit/JIT.cpp:
123+
(JSC::JIT::emitEnterOptimizationCheck):
124+
* jit/JITArithmetic.cpp:
125+
(JSC::JIT::emitMathICFast):
126+
(JSC::JIT::emitMathICSlow):
127+
* jit/JITOpcodes.cpp:
128+
(JSC::JIT::emitSlow_op_new_object):
129+
(JSC::JIT::emit_op_catch):
130+
(JSC::JIT::emit_op_switch_imm):
131+
(JSC::JIT::op_enter_handlerGenerator):
132+
(JSC::JIT::emit_op_debug):
133+
(JSC::JIT::emitSlow_op_loop_hint):
134+
(JSC::JIT::emit_op_new_regexp):
135+
(JSC::JIT::emitNewFuncCommon):
136+
(JSC::JIT::emitNewFuncExprCommon):
137+
(JSC::JIT::emit_op_profile_type):
138+
* jit/JITPropertyAccess.cpp:
139+
(JSC::JIT::emit_op_put_getter_by_id):
140+
(JSC::JIT::emit_op_put_setter_by_id):
141+
(JSC::JIT::emit_op_put_getter_setter_by_id):
142+
(JSC::JIT::emitWriteBarrier):
143+
* wasm/js/WasmToJS.cpp:
144+
(JSC::Wasm::wasmToJS):
145+
1146
2022-04-05 Chris Dumez <cdumez@apple.com>
2147

3148
Avoid unnecessary String constructions in IdentifiersFactory.cpp

‎Source/JavaScriptCore/dfg/DFGArrayifySlowPathGenerator.h‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -94,17 +94,17 @@ class ArrayifySlowPathGenerator final : public JumpingSlowPathGenerator<MacroAss
9494
VM& vm = jit->vm();
9595
switch (m_arrayMode.type()) {
9696
case Array::Int32:
97-
jit->callOperation(operationEnsureInt32, m_tempGPR, &vm, m_baseGPR);
97+
jit->callOperation(operationEnsureInt32, m_tempGPR, SpeculativeJIT::TrustedImmPtr(&vm), m_baseGPR);
9898
break;
9999
case Array::Double:
100-
jit->callOperation(operationEnsureDouble, m_tempGPR, &vm, m_baseGPR);
100+
jit->callOperation(operationEnsureDouble, m_tempGPR, SpeculativeJIT::TrustedImmPtr(&vm), m_baseGPR);
101101
break;
102102
case Array::Contiguous:
103-
jit->callOperation(operationEnsureContiguous, m_tempGPR, &vm, m_baseGPR);
103+
jit->callOperation(operationEnsureContiguous, m_tempGPR, SpeculativeJIT::TrustedImmPtr(&vm), m_baseGPR);
104104
break;
105105
case Array::ArrayStorage:
106106
case Array::SlowPutArrayStorage:
107-
jit->callOperation(operationEnsureArrayStorage, m_tempGPR, &vm, m_baseGPR);
107+
jit->callOperation(operationEnsureArrayStorage, m_tempGPR, SpeculativeJIT::TrustedImmPtr(&vm), m_baseGPR);
108108
break;
109109
default:
110110
CRASH();

‎Source/JavaScriptCore/dfg/DFGCallArrayAllocatorSlowPathGenerator.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ class CallArrayAllocatorSlowPathGenerator final : public JumpingSlowPathGenerato
5555
linkFrom(jit);
5656
for (unsigned i = 0; i < m_plans.size(); ++i)
5757
jit->silentSpill(m_plans[i]);
58-
jit->callOperation(m_function, m_resultGPR, &jit->vm(), m_structure, m_size, m_storageGPR);
58+
jit->callOperation(m_function, m_resultGPR, SpeculativeJIT::TrustedImmPtr(&jit->vm()), m_structure, m_size, m_storageGPR);
5959
for (unsigned i = m_plans.size(); i--;)
6060
jit->silentFill(m_plans[i]);
6161
jit->m_jit.exceptionCheck();

‎Source/JavaScriptCore/dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ class CallCreateDirectArgumentsSlowPathGenerator final : public JumpingSlowPathG
5656
for (unsigned i = 0; i < m_plans.size(); ++i)
5757
jit->silentSpill(m_plans[i]);
5858
jit->callOperation(
59-
operationCreateDirectArguments, m_resultGPR, &jit->vm(), m_structure, m_lengthGPR, m_minCapacity);
59+
operationCreateDirectArguments, m_resultGPR, SpeculativeJIT::TrustedImmPtr(&jit->vm()), m_structure, m_lengthGPR, m_minCapacity);
6060
for (unsigned i = m_plans.size(); i--;)
6161
jit->silentFill(m_plans[i]);
6262
jit->m_jit.exceptionCheck();

‎Source/JavaScriptCore/dfg/DFGJITCompiler.cpp‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -346,7 +346,8 @@ void JITCompiler::compile()
346346
if (maxFrameExtentForSlowPathCall)
347347
addPtr(TrustedImm32(-static_cast<int32_t>(maxFrameExtentForSlowPathCall)), stackPointerRegister);
348348

349-
m_speculative->callOperationWithCallFrameRollbackOnException(operationThrowStackOverflowError, m_codeBlock);
349+
emitGetFromCallFrameHeaderPtr(CallFrameSlot::codeBlock, GPRInfo::argumentGPR0);
350+
m_speculative->callOperationWithCallFrameRollbackOnException(operationThrowStackOverflowError, GPRInfo::argumentGPR0);
350351

351352
// Generate slow path code.
352353
m_speculative->runSlowPathGenerators(m_pcToCodeOriginMapBuilder);
@@ -419,7 +420,8 @@ void JITCompiler::compileFunction()
419420
if (maxFrameExtentForSlowPathCall)
420421
addPtr(TrustedImm32(-static_cast<int32_t>(maxFrameExtentForSlowPathCall)), stackPointerRegister);
421422

422-
m_speculative->callOperationWithCallFrameRollbackOnException(operationThrowStackOverflowError, m_codeBlock);
423+
emitGetFromCallFrameHeaderPtr(CallFrameSlot::codeBlock, GPRInfo::argumentGPR0);
424+
m_speculative->callOperationWithCallFrameRollbackOnException(operationThrowStackOverflowError, GPRInfo::argumentGPR0);
423425

424426
// The fast entry point into a function does not check the correct number of arguments
425427
// have been passed to the call (we only use the fast entry point where we can statically

‎Source/JavaScriptCore/dfg/DFGOSRExit.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,10 +56,10 @@ OSRExit::OSRExit(ExitKind kind, JSValueSource jsValueSource, MethodOfGettingAVal
5656
{
5757
bool canExit = jit->m_origin.exitOK;
5858
if (!canExit && jit->m_currentNode) {
59-
ExitMode exitMode = mayExit(jit->m_jit.graph(), jit->m_currentNode);
59+
ExitMode exitMode = mayExit(jit->m_graph, jit->m_currentNode);
6060
canExit = exitMode == ExitMode::Exits || exitMode == ExitMode::ExitsForExceptions;
6161
}
62-
DFG_ASSERT(jit->m_jit.graph(), jit->m_currentNode, canExit);
62+
DFG_ASSERT(jit->m_graph, jit->m_currentNode, canExit);
6363
}
6464

6565
CodeLocationJump<JSInternalPtrTag> OSRExit::codeLocationForRepatch() const
@@ -747,7 +747,7 @@ void OSRExit::compileExit(CCallHelpers& jit, VM& vm, const OSRExit& exit, const
747747

748748
if (inlineStackContainsActiveCheckpoint) {
749749
EncodedJSValue* tmpScratch = scratch + operands.tmpIndex(0);
750-
jit.setupArguments<decltype(operationMaterializeOSRExitSideState)>(&vm, &exit, tmpScratch);
750+
jit.setupArguments<decltype(operationMaterializeOSRExitSideState)>(CCallHelpers::TrustedImmPtr(&vm), CCallHelpers::TrustedImmPtr(&exit), CCallHelpers::TrustedImmPtr(tmpScratch));
751751
jit.prepareCallOperation(vm);
752752
jit.move(AssemblyHelpers::TrustedImmPtr(tagCFunction<OperationPtrTag>(operationMaterializeOSRExitSideState)), GPRInfo::nonArgGPR0);
753753
jit.call(GPRInfo::nonArgGPR0, OperationPtrTag);

‎Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -343,7 +343,7 @@ static void osrWriteBarrier(VM& vm, CCallHelpers& jit, GPRReg owner, GPRReg scra
343343
{
344344
AssemblyHelpers::Jump ownerIsRememberedOrInEden = jit.barrierBranchWithoutFence(owner);
345345

346-
jit.setupArguments<decltype(operationOSRWriteBarrier)>(&vm, owner);
346+
jit.setupArguments<decltype(operationOSRWriteBarrier)>(CCallHelpers::TrustedImmPtr(&vm), owner);
347347
jit.prepareCallOperation(vm);
348348
jit.move(MacroAssembler::TrustedImmPtr(tagCFunction<OperationPtrTag>(operationOSRWriteBarrier)), scratch);
349349
jit.call(scratch, OperationPtrTag);

0 commit comments

Comments
 (0)