Changeset 271422 in webkit for trunk/Source/JavaScriptCore/ftl/FTLOutput.h

Timestamp:

Jan 12, 2021, 4:09:16 PM (5 years ago)

Author:

[email protected]

Message:

[JSC] Bypass OperationPtrTagging for JITCage verification for CallDOMGetter
​https://bugs.webkit.org/show_bug.cgi?id=220564

Reviewed by Saam Barati.

JSTests:

• stress/domjit-getter2.js: Added.

(shouldBe):
(access):

Source/JavaScriptCore:

CustomAccessorPtrTag functions are not registered ones for JITCage since we are using C++ trampoline to invoke them.
However, we do not want to use this trampoline in x64 due to performance issue. So we would like to call these
functions directly from JIT while they are not registered (And this is OK in JITCage since they are called from trampoline).
In this patch we bypass OperationPtrTagging by using WTF::tagNativeCodePtrImpl directly for non JITCage case.

• dfg/DFGJITCompiler.h:

(JSC::DFG::JITCompiler::appendOperationCall):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCallDOMGetter):

• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::appendOperationCall):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileCallDOMGetter):
(JSC::FTL::DFG::LowerDFGToB3::vmCall):

• ftl/FTLOutput.h:

(JSC::FTL::Output::operation):

• tools/JSDollarVM.cpp:

File:

• trunk/Source/JavaScriptCore/ftl/FTLOutput.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ftl/FTLOutput.h

@@ -403 +403 @@
     template<typename FunctionType>
     LValue operation(FunctionType function) { return constIntPtr(tagCFunctionPtr<void*, OperationPtrTag>(function)); }
+    LValue operation(FunctionPtr<OperationPtrTag> function) { return constIntPtr(function.executableAddress()); }
 
     void jump(LBasicBlock);