Changeset 270764 in webkit for trunk/Source/JavaScriptCore/jit/Repatch.cpp

Timestamp:

Dec 14, 2020, 2:32:10 AM (5 years ago)

Author:

[email protected]

Message:

[JSC] Introduce vmEntryCustomAccessor and vmEntryHostFunction for JITCage
​https://bugs.webkit.org/show_bug.cgi?id=219847

Reviewed by Mark Lam.

Source/JavaScriptCore:

Instead of registering all host-functions and custom accessors with OperationPtrTag or HostFunctionPtrTag,
this patch introduces a trampoline which invokes them with special ptr-tag to reduce memory usage of JITOperationList.

When invoking custom accessor, we pass that pointer as a forth argument, and call vmEntryCustomAccessor.
And vmEntryCustomAccessor jumps to the passed argument with special ptr tag. And we register vmEntryCustomAccessor as an operation.
For host-functions, we pass that pointer as a third argument.

• assembler/JITOperationList.cpp:

(JSC::addPointers):
(JSC::JITOperationList::populatePointersInJavaScriptCore):
(JSC::JITOperationList::populatePointersInJavaScriptCoreForLLInt):
(JSC::JITOperationList::populatePointersInEmbedder):

• assembler/JITOperationList.h:

(JSC::JITOperationList::assertIsHostFunction): Deleted.

• b3/testb3_1.cpp:

(main):

• bytecode/AccessCase.cpp:

(JSC::AccessCase::generateImpl):

• bytecode/GetByIdVariant.cpp:

(JSC::GetByIdVariant::GetByIdVariant):

• bytecode/GetByIdVariant.h:

(JSC::GetByIdVariant::customAccessorGetter const):

• bytecode/GetByStatus.cpp:

(JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):

• bytecode/GetterSetterAccessCase.cpp:

(JSC::GetterSetterAccessCase::create):

• bytecode/GetterSetterAccessCase.h:
• dfg/DFGNode.h:
• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCallDOMGetter):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileCallDOMGetter):

• jit/JITOperations.h:
• jit/Repatch.cpp:

(JSC::tryCacheGetBy):
(JSC::tryCachePutByID):

• jit/ThunkGenerators.cpp:

(JSC::nativeForGenerator):

• jsc.cpp:

(jscmain):

• llint/LLIntData.cpp:

(JSC::LLInt::initialize):

• llint/LLIntThunks.cpp:
• llint/LLIntThunks.h:
• llint/LowLevelInterpreter.asm:
• llint/LowLevelInterpreter64.asm:
• runtime/Gate.h:
• runtime/JSCPtrTag.h:

(JSC::tagJSCCodePtrImpl):
(JSC::untagJSCCodePtrImpl):

• runtime/NativeFunction.h:
• runtime/PropertySlot.h:
• runtime/PutPropertySlot.h:

(JSC::PutPropertySlot::customSetter const):

• runtime/VM.cpp:

(JSC::VM::getHostFunction):

Source/WebCore:

• bindings/js/WebCoreJITOperations.cpp:

(WebCore::populateJITOperations):

• testing/js/WebCoreTestSupport.cpp:

(WebCoreTestSupport::populateJITOperations):

Source/WebKit:

• Shared/WebKitJITOperations.cpp:

(WebKit::populateJITOperations):

Source/WTF:

• wtf/PlatformCallingConventions.h:

File:

• trunk/Source/JavaScriptCore/jit/Repatch.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/jit/Repatch.cpp

@@ -411 +411 @@
                     newCase = GetterSetterAccessCase::create(
                         vm, codeBlock, type, propertyName, offset, structure, conditionSet, loadTargetFromProxy,
-                        slot.watchpointSet(), slot.isCacheableCustom() ? FunctionPtr<OperationPtrTag>(slot.customGetter()) : nullptr,
+                        slot.watchpointSet(), slot.isCacheableCustom() ? FunctionPtr<CustomAccessorPtrTag>(slot.customGetter()) : nullptr,
                         slot.isCacheableCustom() && slot.slotBase() != baseValue ? slot.slotBase() : nullptr,
                         domAttribute, WTFMove(prototypeAccessChain));
@@ -747 +747 @@
                 newCase = GetterSetterAccessCase::create(
                     vm, codeBlock, slot.isCustomAccessor() ? AccessCase::CustomAccessorSetter : AccessCase::CustomValueSetter, oldStructure, propertyName,
-                    invalidOffset, conditionSet, WTFMove(prototypeAccessChain), isProxy, slot.customSetter().retagged<OperationPtrTag>(), slot.base() != baseValue ? slot.base() : nullptr);
+                    invalidOffset, conditionSet, WTFMove(prototypeAccessChain), isProxy, slot.customSetter().retagged<CustomAccessorPtrTag>(), slot.base() != baseValue ? slot.base() : nullptr);
             } else {
                 ASSERT(slot.isCacheableSetter());