Skip to content

Commit 7a29252

Browse files
ConstellationConstellation
committed
[JSC] Implement growable SharedArrayBuffer part 1
https://bugs.webkit.org/show_bug.cgi?id=247541 rdar://102006760 Reviewed by Mark Lam. This patch adds first patch for growable SharedArrayBuffer. This patch does not add TypedArray's length tracking (when backing ArrayBuffer is resized, then TypedArray's length needs to be changed too). 1. We extract Wasm::MemoryHandle to runtime to use it for non wasm. This offers growable memory infrastructure since it was used for growable shared Wasm::Memory. This also requires moving MemoryMode, MemorySharingMode, and PageCount from wasm to runtime. 2. We add resizable TypedArrayTypes, and currently DFG does OSR exit when we encounter it. We also change it from uint32_t to uint8_t to make room in TypedArray to have more information. 3. This patch adds growable SharedArrayBuffer's methods. 4. We add OSAllocator::protect to make (1) work on Windows too. * JSTests/test262/config.yaml: * JSTests/test262/expectations.yaml: * JSTests/wasm/stress/shared-wasm-memory-buffer.js: * Source/JavaScriptCore/CMakeLists.txt: * Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj: * Source/JavaScriptCore/Sources.txt: * Source/JavaScriptCore/bytecode/AccessCase.cpp: (JSC::AccessCase::generateWithGuard): * Source/JavaScriptCore/bytecode/ExitKind.cpp: (JSC::exitKindToString): * Source/JavaScriptCore/bytecode/ExitKind.h: * Source/JavaScriptCore/dfg/DFGOperations.cpp: (JSC::DFG::newTypedArrayWithSize): * Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds): (JSC::DFG::SpeculativeJIT::jumpForTypedArrayIsDetachedIfOutOfBounds): * Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52): (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffsetAsInt52): (JSC::DFG::SpeculativeJIT::compile): * Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h: * Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::emitGetTypedArrayByteOffsetExceptSettingResult): (JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength): (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayLengthAsInt52): (JSC::FTL::DFG::LowerDFGToB3::emitNewTypedArrayWithSize): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * Source/JavaScriptCore/heap/StructureAlignedMemoryAllocator.cpp: (JSC::StructureMemoryManager::commitBlock): (JSC::StructureMemoryManager::decommitBlock): * Source/JavaScriptCore/jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::branchIfFastTypedArray): (JSC::AssemblyHelpers::branchIfNotFastTypedArray): * Source/JavaScriptCore/jit/IntrinsicEmitter.cpp: (JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter): * Source/JavaScriptCore/jsc.cpp: (JSC_DEFINE_HOST_FUNCTION): * Source/JavaScriptCore/llint/LowLevelInterpreter.asm: * Source/JavaScriptCore/llint/WebAssembly.asm: * Source/JavaScriptCore/runtime/ArrayBuffer.cpp: (JSC::ArrayBufferContents::tryAllocate): (JSC::ArrayBufferContents::makeShared): (JSC::ArrayBufferContents::copyTo): (JSC::ArrayBufferContents::shareWith): (JSC::ArrayBuffer::createFromBytes): (JSC::ArrayBuffer::createShared): (JSC::ArrayBuffer::tryCreate): (JSC::ArrayBuffer::grow): (JSC::tryAllocate): (JSC::ArrayBuffer::tryCreateShared): (JSC::SharedArrayBufferContents::grow): * Source/JavaScriptCore/runtime/ArrayBuffer.h: (JSC::ArrayBuffer::byteLength const): (JSC::ArrayBuffer::maxByteLength const): (JSC::IdempotentArrayBufferByteLengthGetter::IdempotentArrayBufferByteLengthGetter): (JSC::IdempotentArrayBufferByteLengthGetter::operator()): * Source/JavaScriptCore/runtime/BufferMemoryHandle.cpp: Added. (JSC::BufferMemoryHandle::fastMappedRedzoneBytes): (JSC::BufferMemoryHandle::fastMappedBytes): (JSC::BufferMemoryResult::toString): (JSC::BufferMemoryResult::dump const): (JSC::BufferMemoryManager::tryAllocateFastMemory): (JSC::BufferMemoryManager::freeFastMemory): (JSC::BufferMemoryManager::tryAllocateGrowableBoundsCheckingMemory): (JSC::BufferMemoryManager::freeGrowableBoundsCheckingMemory): (JSC::BufferMemoryManager::isInGrowableOrFastMemory): (JSC::BufferMemoryManager::tryAllocatePhysicalBytes): (JSC::BufferMemoryManager::freePhysicalBytes): (JSC::BufferMemoryManager::dump const): (JSC::BufferMemoryManager::singleton): (JSC::BufferMemoryHandle::BufferMemoryHandle): (JSC::BufferMemoryHandle::~BufferMemoryHandle): (JSC::BufferMemoryHandle::memory const): * Source/JavaScriptCore/runtime/BufferMemoryHandle.h: Added. (JSC::BufferMemoryResult::BufferMemoryResult): (JSC::BufferMemoryManager::memoryLimit const): * Source/JavaScriptCore/runtime/CommonIdentifiers.h: * Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp: (JSC::JSGenericArrayBufferConstructor<sharingMode>::constructImpl): * Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp: (JSC::arrayBufferSlice): (JSC::JSC_DEFINE_HOST_FUNCTION): (JSC::JSArrayBufferPrototype::finishCreation): * Source/JavaScriptCore/runtime/JSArrayBufferView.cpp: (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext): (JSC::JSArrayBufferView::JSArrayBufferView): (JSC::JSArrayBufferView::finishCreation): (JSC::JSArrayBufferView::detach): (JSC::JSArrayBufferView::slowDownAndWasteMemory): (JSC::isIntegerIndexedObjectOutOfBounds): (JSC::integerIndexedObjectLength): (JSC::integerIndexedObjectByteLength): (WTF::printInternal): * Source/JavaScriptCore/runtime/JSArrayBufferView.h: (JSC::hasArrayBuffer): (JSC::isResizable): (JSC::JSArrayBufferView::ConstructionContext::vector const): (JSC::JSArrayBufferView::ConstructionContext::maxByteLength const): (JSC::JSArrayBufferView::ConstructionContext::maxByteLengthUnsafe const): (JSC::JSArrayBufferView::vector const): (JSC::JSArrayBufferView::maxByteLength const): (JSC::JSArrayBufferView::offsetOfMaxByteLength): * Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h: (JSC::JSArrayBufferView::isShared): (JSC::JSArrayBufferView::possiblySharedBufferImpl): (JSC::JSArrayBufferView::existingBufferInButterfly): * Source/JavaScriptCore/runtime/JSCJSValue.h: * Source/JavaScriptCore/runtime/JSCJSValueInlines.h: (JSC::JSValue::toTypedArrayIndex const): * Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h: * Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h: (JSC::constructGenericTypedArrayViewWithArguments): (JSC::constructGenericTypedArrayViewImpl): * Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h: (JSC::JSGenericTypedArrayView<Adaptor>::deletePropertyByIndex): (JSC::JSGenericTypedArrayView<Adaptor>::visitChildrenImpl): * Source/JavaScriptCore/runtime/MemoryMode.cpp: Renamed from Source/JavaScriptCore/wasm/WasmMemoryMode.cpp. (WTF::printInternal): * Source/JavaScriptCore/runtime/MemoryMode.h: Renamed from Source/JavaScriptCore/wasm/WasmMemoryMode.h. * Source/JavaScriptCore/runtime/OptionsList.h: * Source/JavaScriptCore/runtime/PageCount.cpp: Renamed from Source/JavaScriptCore/wasm/WasmPageCount.cpp. (JSC::PageCount::dump const): * Source/JavaScriptCore/runtime/PageCount.h: Renamed from Source/JavaScriptCore/wasm/WasmPageCount.h. (JSC::PageCount::PageCount): (JSC::PageCount::bytes const): (JSC::PageCount::pageCount const): (JSC::PageCount::isValid): (JSC::PageCount::isValid const): (JSC::PageCount::fromBytes): (JSC::PageCount::fromBytesWithRoundUp): (JSC::PageCount::max): (JSC::PageCount::operator bool const): (JSC::PageCount::operator< const): (JSC::PageCount::operator> const): (JSC::PageCount::operator>= const): (JSC::PageCount::operator== const): (JSC::PageCount::operator!= const): (JSC::PageCount::operator+ const): * Source/JavaScriptCore/runtime/StructureInlines.h: (JSC::Structure::hasIndexingHeader const): * Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp: (JSC::Wasm::AirIRGenerator::addCurrentMemory): * Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::addCurrentMemory): * Source/JavaScriptCore/wasm/WasmCallee.h: * Source/JavaScriptCore/wasm/WasmCalleeGroup.cpp: (JSC::Wasm::CalleeGroup::isSafeToRun): * Source/JavaScriptCore/wasm/WasmCalleeGroup.h: * Source/JavaScriptCore/wasm/WasmFormat.h: * Source/JavaScriptCore/wasm/WasmMemory.cpp: (JSC::Wasm::Memory::Memory): (JSC::Wasm::Memory::create): (JSC::Wasm::Memory::createZeroSized): (JSC::Wasm::Memory::tryCreate): (JSC::Wasm::Memory::addressIsInGrowableOrFastMemory): (JSC::Wasm::Memory::growShared): (JSC::Wasm::Memory::grow): (JSC::Wasm::Memory::dump const): (JSC::Wasm::MemoryHandle::MemoryHandle): Deleted. (JSC::Wasm::MemoryHandle::~MemoryHandle): Deleted. (JSC::Wasm::MemoryHandle::memory const): Deleted. (JSC::Wasm::Memory::fastMappedRedzoneBytes): Deleted. (JSC::Wasm::Memory::fastMappedBytes): Deleted. * Source/JavaScriptCore/wasm/WasmMemory.h: (JSC::Wasm::Memory::maxFastMemoryCount): Deleted. * Source/JavaScriptCore/wasm/WasmMemoryInformation.h: * Source/JavaScriptCore/wasm/WasmModule.cpp: (JSC::Wasm::Module::copyInitialCalleeGroupToAllMemoryModes): * Source/JavaScriptCore/wasm/WasmModule.h: * Source/JavaScriptCore/wasm/WasmOperations.cpp: (JSC::Wasm::JSC_DEFINE_JIT_OPERATION): * Source/JavaScriptCore/wasm/js/JSToWasm.cpp: (JSC::Wasm::createJSToWasmWrapper): * Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp: (JSC::JSWebAssemblyInstance::tryCreate): * Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h: * Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp: (JSC::JSWebAssemblyMemory::buffer): (JSC::JSWebAssemblyMemory::grow): (JSC::JSWebAssemblyMemory::type): (JSC::JSWebAssemblyMemory::growSuccessCallback): * Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.h: * Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.h: * Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp: (JSC::WebAssemblyFunction::calleeSaves const): (JSC::WebAssemblyFunction::jsCallEntrypointSlow): * Source/JavaScriptCore/wasm/js/WebAssemblyMemoryConstructor.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * Source/JavaScriptCore/wasm/js/WebAssemblyMemoryPrototype.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp: (JSC::WebAssemblyModuleRecord::initializeImports): * Source/WTF/wtf/OSAllocator.h: * Source/WTF/wtf/posix/OSAllocatorPOSIX.cpp: (WTF::OSAllocator::protect): * Source/WTF/wtf/win/OSAllocatorWin.cpp: (WTF::OSAllocator::protect): * Source/WebCore/bindings/js/SerializedScriptValue.cpp: (WebCore::CloneSerializer::dumpIfTerminal): (WebCore::CloneDeserializer::readTerminal): * Source/WebCore/bindings/js/SerializedScriptValue.h: Canonical link: https://commits.webkit.org/256524@main
1 parent 7c870a9 commit 7a29252

67 files changed

Lines changed: 1997 additions & 741 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎JSTests/test262/config.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,13 @@ flags:
1313
ShadowRealm: useShadowRealm
1414
import-assertions: useImportAssertion
1515
json-modules: useImportAssertion
16+
resizable-arraybuffer: useResizableArrayBuffer
1617
skip:
1718
features:
1819
- Atomics.waitAsync
1920
# https://bugs.webkit.org/show_bug.cgi?id=174931
2021
- regexp-lookbehind
2122
- regexp-v-flag
22-
- resizable-arraybuffer
2323
- callable-boundary-realms
2424
- FinalizationRegistry.prototype.cleanupSome
2525
- decorators

‎JSTests/test262/expectations.yaml‎

Lines changed: 543 additions & 0 deletions
Large diffs are not rendered by default.

‎Source/JavaScriptCore/CMakeLists.txt‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -956,6 +956,7 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEADERS
956956
runtime/BooleanObject.h
957957
runtime/BooleanPrototype.h
958958
runtime/BrandedStructure.h
959+
runtime/BufferMemoryHandle.h
959960
runtime/Butterfly.h
960961
runtime/ButterflyInlines.h
961962
runtime/BytecodeCacheError.h
@@ -1136,6 +1137,7 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEADERS
11361137
runtime/Lookup.h
11371138
runtime/MatchResult.h
11381139
runtime/MathCommon.h
1140+
runtime/MemoryMode.h
11391141
runtime/MemoryStatistics.h
11401142
runtime/Microtask.h
11411143
runtime/ModuleProgramExecutable.h
@@ -1152,6 +1154,7 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEADERS
11521154
runtime/Operations.h
11531155
runtime/Options.h
11541156
runtime/OptionsList.h
1157+
runtime/PageCount.h
11551158
runtime/ParseInt.h
11561159
runtime/PrivateFieldPutKind.h
11571160
runtime/PrivateName.h
@@ -1268,13 +1271,11 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEADERS
12681271
wasm/WasmLLIntTierUpCounter.h
12691272
wasm/WasmMemory.h
12701273
wasm/WasmMemoryInformation.h
1271-
wasm/WasmMemoryMode.h
12721274
wasm/WasmModule.h
12731275
wasm/WasmModuleInformation.h
12741276
wasm/WasmName.h
12751277
wasm/WasmNameSection.h
12761278
wasm/WasmOSREntryData.h
1277-
wasm/WasmPageCount.h
12781279
wasm/WasmSIMDOpcodes.h
12791280
wasm/WasmSections.h
12801281
wasm/WasmTypeDefinition.h

‎Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj‎

Lines changed: 18 additions & 12 deletions
Large diffs are not rendered by default.

‎Source/JavaScriptCore/Sources.txt‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -762,6 +762,7 @@ runtime/BooleanConstructor.cpp
762762
runtime/BooleanObject.cpp
763763
runtime/BooleanPrototype.cpp
764764
runtime/BrandedStructure.cpp
765+
runtime/BufferMemoryHandle.cpp
765766
runtime/BytecodeCacheError.cpp
766767
runtime/CallData.cpp
767768
runtime/CachePayload.cpp
@@ -964,6 +965,7 @@ runtime/MapPrototype.cpp
964965
runtime/MatchResult.cpp
965966
runtime/MathCommon.cpp
966967
runtime/MathObject.cpp
968+
runtime/MemoryMode.cpp
967969
runtime/MemoryStatistics.cpp
968970
runtime/ModuleProgramExecutable.cpp
969971
runtime/NarrowingNumberPredictionFuzzerAgent.cpp
@@ -981,6 +983,7 @@ runtime/ObjectInitializationScope.cpp
981983
runtime/ObjectPrototype.cpp
982984
runtime/Operations.cpp
983985
runtime/Options.cpp
986+
runtime/PageCount.cpp
984987
runtime/PredictionFileCreatingFuzzerAgent.cpp
985988
runtime/PrivateFieldPutKind.cpp
986989
runtime/ProgramExecutable.cpp
@@ -1124,15 +1127,13 @@ wasm/WasmLLIntTierUpCounter.cpp
11241127
wasm/WasmMachineThreads.cpp
11251128
wasm/WasmMemory.cpp
11261129
wasm/WasmMemoryInformation.cpp
1127-
wasm/WasmMemoryMode.cpp
11281130
wasm/WasmModule.cpp
11291131
wasm/WasmModuleInformation.cpp
11301132
wasm/WasmNameSectionParser.cpp
11311133
wasm/WasmOMGPlan.cpp
11321134
wasm/WasmOSREntryPlan.cpp
11331135
wasm/WasmOpcodeOrigin.cpp
11341136
wasm/WasmOperations.cpp
1135-
wasm/WasmPageCount.cpp
11361137
wasm/WasmPlan.cpp
11371138
wasm/WasmSectionParser.cpp
11381139
wasm/WasmTypeDefinition.cpp

‎Source/JavaScriptCore/bytecode/AccessCase.cpp‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1237,9 +1237,9 @@ void AccessCase::generateWithGuard(
12371237
jit, ScratchRegisterAllocator::ExtraStackSpace::NoExtraSpace);
12381238

12391239
#if USE(LARGE_TYPED_ARRAYS)
1240-
jit.load64(addressOfLength, scratchGPR);
1240+
jit.load64(CCallHelpers::Address(baseGPR, JSArrayBufferView::offsetOfMaxByteLength()), scratchGPR);
12411241
#else
1242-
jit.load32(addressOfLength, scratchGPR);
1242+
jit.load32(CCallHelpers::Address(baseGPR, JSArrayBufferView::offsetOfMaxByteLength()), scratchGPR);
12431243
#endif
12441244
jit.loadPtr(CCallHelpers::Address(baseGPR, JSArrayBufferView::offsetOfVector()), scratch2GPR);
12451245
jit.cageConditionallyAndUntag(Gigacage::Primitive, scratch2GPR, scratchGPR, scratchGPR, false);
@@ -1661,9 +1661,9 @@ void AccessCase::generateWithGuard(
16611661
jit, ScratchRegisterAllocator::ExtraStackSpace::NoExtraSpace);
16621662

16631663
#if USE(LARGE_TYPED_ARRAYS)
1664-
jit.load64(addressOfLength, scratchGPR);
1664+
jit.load64(CCallHelpers::Address(baseGPR, JSArrayBufferView::offsetOfMaxByteLength()), scratchGPR);
16651665
#else
1666-
jit.load32(addressOfLength, scratchGPR);
1666+
jit.load32(CCallHelpers::Address(baseGPR, JSArrayBufferView::offsetOfMaxByteLength()), scratchGPR);
16671667
#endif
16681668
jit.loadPtr(CCallHelpers::Address(baseGPR, JSArrayBufferView::offsetOfVector()), scratch2GPR);
16691669
jit.cageConditionallyAndUntag(Gigacage::Primitive, scratch2GPR, scratchGPR, scratchGPR, false);

‎Source/JavaScriptCore/bytecode/ExitKind.cpp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,8 @@ ASCIILiteral exitKindToString(ExitKind kind)
9393
return "GenericUnwind"_s;
9494
case BigInt32Overflow:
9595
return "BigInt32Overflow"_s;
96+
case UnexpectedResizableArrayBufferView:
97+
return "UnexpectedResizableArrayBufferView"_s;
9698
}
9799
RELEASE_ASSERT_NOT_REACHED();
98100
return "Unknown"_s;

‎Source/JavaScriptCore/bytecode/ExitKind.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ enum ExitKind : uint8_t {
5959
ExceptionCheck, // We exited because a direct exception check showed that we threw an exception from a C call.
6060
GenericUnwind, // We exited because we arrived at this OSR exit from genericUnwind.
6161
BigInt32Overflow, // We exited because of an BigInt32 overflow.
62+
UnexpectedResizableArrayBufferView, // We exited because we made an incorrect assumption about what type of ArrayBufferView we would see.
6263
};
6364

6465
ASCIILiteral exitKindToString(ExitKind);

‎Source/JavaScriptCore/dfg/DFGOperations.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,7 @@ char* newTypedArrayWithSize(JSGlobalObject* globalObject, VM& vm, Structure* str
195195
size_t unsignedSize = static_cast<size_t>(size);
196196

197197
if (vector)
198-
return bitwise_cast<char*>(ViewClass::createWithFastVector(globalObject, structure, unsignedSize, untagArrayPtr(vector, unsignedSize)));
198+
return bitwise_cast<char*>(ViewClass::createWithFastVector(globalObject, structure, unsignedSize, untagArrayPtr(vector, unsignedSize * ViewClass::elementSize)));
199199

200200
RELEASE_AND_RETURN(scope, bitwise_cast<char*>(ViewClass::create(globalObject, structure, unsignedSize)));
201201
}

‎Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp‎

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3608,6 +3608,8 @@ JITCompiler::Jump SpeculativeJIT::jumpForTypedArrayOutOfBounds(Node* node, GPRRe
36083608
#endif
36093609
}
36103610

3611+
// FIXME: We should record UnexpectedResizableArrayBufferView in ArrayProfile, propagate it to DFG::ArrayMode, and accept it here.
3612+
speculationCheck(UnexpectedResizableArrayBufferView, JSValueSource::unboxedCell(baseGPR), node, m_jit.branch8(MacroAssembler::Equal, CCallHelpers::Address(baseGPR, JSArrayBufferView::offsetOfMode()), TrustedImm32(ResizableWastefulTypedArray)));
36113613
#if USE(LARGE_TYPED_ARRAYS)
36123614
m_jit.signExtend32ToPtr(indexGPR, scratchGPR);
36133615
return m_jit.branch64(
@@ -3638,10 +3640,12 @@ JITCompiler::Jump SpeculativeJIT::jumpForTypedArrayIsDetachedIfOutOfBounds(Node*
36383640
else {
36393641
outOfBounds.link(&m_jit);
36403642

3641-
JITCompiler::Jump notWasteful = m_jit.branch32(
3642-
MacroAssembler::NotEqual,
3643+
JITCompiler::Jump notWasteful = m_jit.branch8(
3644+
MacroAssembler::Below,
36433645
MacroAssembler::Address(base, JSArrayBufferView::offsetOfMode()),
36443646
TrustedImm32(WastefulTypedArray));
3647+
// FIXME: We should record UnexpectedResizableArrayBufferView in ArrayProfile, propagate it to DFG::ArrayMode, and accept it here.
3648+
speculationCheck(UnexpectedResizableArrayBufferView, JSValueSource::unboxedCell(base), node, m_jit.branch8(CCallHelpers::Equal, CCallHelpers::Address(base, JSArrayBufferView::offsetOfMode()), TrustedImm32(ResizableWastefulTypedArray)));
36453649

36463650
JITCompiler::Jump hasNullVector;
36473651
#if CPU(ARM64E)
@@ -8403,7 +8407,7 @@ void SpeculativeJIT::cageTypedArrayStorage(GPRReg baseReg, GPRReg storageReg, bo
84038407
{
84048408
auto untagArrayPtr = [&]() {
84058409
#if CPU(ARM64E)
8406-
m_jit.untagArrayPtrLength64(MacroAssembler::Address(baseReg, JSArrayBufferView::offsetOfLength()), storageReg, validateAuth);
8410+
m_jit.untagArrayPtrLength64(MacroAssembler::Address(baseReg, JSArrayBufferView::offsetOfMaxByteLength()), storageReg, validateAuth);
84078411
#else
84088412
UNUSED_PARAM(validateAuth);
84098413
UNUSED_PARAM(baseReg);
@@ -8483,10 +8487,12 @@ void SpeculativeJIT::compileGetTypedArrayByteOffset(Node* node)
84838487

84848488
GPRReg arrayBufferGPR = dataGPR;
84858489

8486-
JITCompiler::Jump emptyByteOffset = m_jit.branch32(
8487-
MacroAssembler::NotEqual,
8490+
JITCompiler::Jump emptyByteOffset = m_jit.branch8(
8491+
MacroAssembler::Below,
84888492
MacroAssembler::Address(baseGPR, JSArrayBufferView::offsetOfMode()),
84898493
TrustedImm32(WastefulTypedArray));
8494+
// FIXME: We should record UnexpectedResizableArrayBufferView in ArrayProfile, propagate it to DFG::ArrayMode, and accept it here.
8495+
speculationCheck(UnexpectedResizableArrayBufferView, JSValueSource::unboxedCell(baseGPR), node, m_jit.branch8(MacroAssembler::Equal, CCallHelpers::Address(baseGPR, JSArrayBufferView::offsetOfMode()), TrustedImm32(ResizableWastefulTypedArray)));
84908496

84918497
m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArrayBufferView::offsetOfVector()), vectorGPR);
84928498

@@ -8791,6 +8797,8 @@ void SpeculativeJIT::compileGetArrayLength(Node* node)
87918797
GPRTemporary result(this);
87928798
GPRReg baseGPR = base.gpr();
87938799
GPRReg resultGPR = result.gpr();
8800+
// FIXME: We should record UnexpectedResizableArrayBufferView in ArrayProfile, propagate it to DFG::ArrayMode, and accept it here.
8801+
speculationCheck(UnexpectedResizableArrayBufferView, JSValueSource::unboxedCell(baseGPR), node, m_jit.branch8(MacroAssembler::Equal, CCallHelpers::Address(baseGPR, JSArrayBufferView::offsetOfMode()), TrustedImm32(ResizableWastefulTypedArray)));
87948802
#if USE(LARGE_TYPED_ARRAYS)
87958803
m_jit.load64(MacroAssembler::Address(baseGPR, JSArrayBufferView::offsetOfLength()), resultGPR);
87968804
speculationCheck(Overflow, JSValueSource(), nullptr, m_jit.branch64(MacroAssembler::Above, resultGPR, TrustedImm64(std::numeric_limits<int32_t>::max())));
@@ -11658,6 +11666,7 @@ void SpeculativeJIT::emitNewTypedArrayWithSizeInRegister(Node* node, TypedArrayT
1165811666
#if CPU(ARM64E)
1165911667
// sizeGPR is still boxed as a number and there is no 32-bit variant of the PAC instructions.
1166011668
m_jit.zeroExtend32ToWord(sizeGPR, scratchGPR);
11669+
m_jit.lshift64(TrustedImm32(logElementSize(typedArrayType)), scratchGPR);
1166111670
m_jit.tagArrayPtr(scratchGPR, storageGPR);
1166211671
#endif
1166311672

@@ -11684,12 +11693,18 @@ void SpeculativeJIT::emitNewTypedArrayWithSizeInRegister(Node* node, TypedArrayT
1168411693
m_jit.store64(
1168511694
sizeGPR,
1168611695
MacroAssembler::Address(resultGPR, JSArrayBufferView::offsetOfLength()));
11696+
m_jit.zeroExtend32ToWord(sizeGPR, scratchGPR);
11697+
m_jit.lshift64(TrustedImm32(logElementSize(typedArrayType)), scratchGPR);
11698+
m_jit.store64(scratchGPR, MacroAssembler::Address(resultGPR, JSArrayBufferView::offsetOfMaxByteLength()));
1168711699
#else
1168811700
m_jit.store32(
1168911701
sizeGPR,
1169011702
MacroAssembler::Address(resultGPR, JSArrayBufferView::offsetOfLength()));
11703+
m_jit.move(sizeGPR, scratchGPR);
11704+
m_jit.lshift32(TrustedImm32(logElementSize(typedArrayType)), scratchGPR);
11705+
m_jit.store32(scratchGPR, MacroAssembler::Address(resultGPR, JSArrayBufferView::offsetOfMaxByteLength()));
1169111706
#endif
11692-
m_jit.store32(
11707+
m_jit.store8(
1169311708
TrustedImm32(FastTypedArray),
1169411709
MacroAssembler::Address(resultGPR, JSArrayBufferView::offsetOfMode()));
1169511710

0 commit comments

Comments
 (0)