Changeset 275392 in webkit for trunk/Source/JavaScriptCore/offlineasm

Timestamp:

Apr 1, 2021, 4:06:51 PM (4 years ago)

Author:

[email protected]

Message:

REGRESSION(r274724): JITCage trampoline needs to be adjusted
​https://bugs.webkit.org/show_bug.cgi?id=224065

Reviewed by Saam Barati.

r274724 introduced a new parameter to custom setters, but it didn't change the parameter recognization of JITCage trampolines for custom accessors.
As a result, we are jumping with the wrong pointer, and crash when custom setter is called with JITCage.

This patch fixes the above bug.

1. Now, custom getter and custom setter have different number of parameters. We should have two different trampolines to invoke it. We remove vmEntryCustomAccessor, and add vmEntryCustomGetter/vmEntryCustomSetter.
2. vmEntryCustomSetter should use a4 parameter as a executable address for trampoline.

• bytecode/AccessCase.cpp:

(JSC::AccessCase::generateImpl):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCallDOMGetter):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileCallDOMGetter):

• llint/LLIntThunks.cpp:
• llint/LLIntThunks.h:
• llint/LowLevelInterpreter.asm:
• offlineasm/arm64.rb:
• offlineasm/registers.rb:
• runtime/PropertySlot.h:

Location:

trunk/Source/JavaScriptCore/offlineasm

Files:

• arm64.rb (modified) (1 diff)
• registers.rb (modified) (1 diff)

trunk/Source/JavaScriptCore/offlineasm/arm64.rb

@@ -136 +136 @@
         when 't3', 'a3', 'wa3'
             arm64GPRName('x3', kind)
-        when 't4', 'wa4'
+        when 't4', 'a4', 'wa4'
             arm64GPRName('x4', kind)
-        when 't5', 'wa5'
+        when 't5', 'a5', 'wa5'
           arm64GPRName('x5', kind)
-        when 't6', 'wa6'
+        when 't6', 'a6', 'wa6'
           arm64GPRName('x6', kind)
-        when 't7', 'wa7'
+        when 't7', 'a7', 'wa7'
           arm64GPRName('x7', kind)
         when 'ws0'

trunk/Source/JavaScriptCore/offlineasm/registers.rb

@@ -39 +39 @@
      "a2",
      "a3",
+     "a4",
+     "a5",
+     "a6",
+     "a7",
      "r0",
      "r1",