Changeset 61830 in webkit for trunk/JavaScriptCore


Ignore:
Timestamp:
Jun 24, 2010, 11:18:37 PM (15 years ago)
Author:
[email protected]
Message:

2010-06-24 Oliver Hunt <​[email protected]>

Reviewed by Maciej Stachowiak.

Incorrect use of '+ 4' and 0 instead of tag and payload offsets in JSValue32_64
​https://bugs.webkit.org/show_bug.cgi?id=41193

I noticed a use of '+ 4' in some of the 32_64 code paths and realised there
were a few places where endianness was being hardcoded. This patch fixes
the errors i could find through code inspection.

  • jit/JITOpcodes32_64.cpp: (JSC::JIT::emit_op_resolve_global):
  • jit/JITPropertyAccess32_64.cpp: (JSC::JIT::emit_op_get_by_val): (JSC::JIT::emit_op_put_by_val): (JSC::JIT::compileGetDirectOffset): (JSC::JIT::privateCompilePutByIdTransition): (JSC::JIT::patchGetByIdSelf): (JSC::JIT::patchPutByIdReplace):
Location:
trunk/JavaScriptCore
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/JavaScriptCore/ChangeLog

    r61817 r61830  
     12010-06-24  Oliver Hunt  <[email protected]>
     2
     3        Reviewed by Maciej Stachowiak.
     4
     5        Incorrect use of '+ 4' and 0 instead of tag and payload offsets in JSValue32_64
     6        https://bugs.webkit.org/show_bug.cgi?id=41193
     7
     8        I noticed a use of '+ 4' in some of the 32_64 code paths and realised there
     9        were a few places where endianness was being hardcoded.  This patch fixes
     10        the errors i could find through code inspection.
     11
     12        * jit/JITOpcodes32_64.cpp:
     13        (JSC::JIT::emit_op_resolve_global):
     14        * jit/JITPropertyAccess32_64.cpp:
     15        (JSC::JIT::emit_op_get_by_val):
     16        (JSC::JIT::emit_op_put_by_val):
     17        (JSC::JIT::compileGetDirectOffset):
     18        (JSC::JIT::privateCompilePutByIdTransition):
     19        (JSC::JIT::patchGetByIdSelf):
     20        (JSC::JIT::patchPutByIdReplace):
     21
    1222010-06-24  Oliver Hunt  <[email protected]>
    223

  • trunk/JavaScriptCore/jit/JITOpcodes32_64.cpp

    r61614 r61830  
    682682    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSGlobalObject, m_externalStorage)), regT2);
    683683    load32(offsetAddr, regT3);
    684     load32(BaseIndex(regT2, regT3, TimesEight), regT0); // payload
    685     load32(BaseIndex(regT2, regT3, TimesEight, 4), regT1); // tag
     684    load32(BaseIndex(regT2, regT3, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT0); // payload
     685    load32(BaseIndex(regT2, regT3, TimesEight, OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT1); // tag
    686686    emitStore(dst, regT1, regT0);
    687687    map(m_bytecodeOffset + dynamic ? OPCODE_LENGTH(op_resolve_global_dynamic) : OPCODE_LENGTH(op_resolve_global), dst, regT1, regT0);

  • trunk/JavaScriptCore/jit/JITPropertyAccess32_64.cpp

    r61180 r61830  
    315315    addSlowCase(branch32(AboveOrEqual, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
    316316   
    317     load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
    318     load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
     317    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT1); // tag
     318    load32(BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT0); // payload
    319319    addSlowCase(branch32(Equal, regT1, Imm32(JSValue::EmptyValueTag)));
    320320   
    … …  
    367367    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT3);
    368368   
    369     Jump empty = branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::EmptyValueTag));
     369    Jump empty = branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), Imm32(JSValue::EmptyValueTag));
    370370   
    371371    Label storeResult(this);
    372372    emitLoad(value, regT1, regT0);
    373     store32(regT0, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))); // payload
    374     store32(regT1, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4)); // tag
     373    store32(regT0, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload))); // payload
     374    store32(regT1, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag))); // tag
    375375    Jump end = jump();
    376376   
    … …  
    572572{
    573573    if (base->isUsingInlineStorage()) {
    574         load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]), resultPayload);
    575         load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]) + 4, resultTag);
     574        load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]) + OBJECT_OFFSETOF(JSValue, u.asBits.payload), resultPayload);
     575        load32(reinterpret_cast<char*>(&base->m_inlineStorage[cachedOffset]) + OBJECT_OFFSETOF(JSValue, u.asBits.tag), resultTag);
    576576        return;
    577577    }
    … …  
    581581    PropertyStorage* protoPropertyStorage = &base->m_externalStorage;
    582582    loadPtr(static_cast<void*>(protoPropertyStorage), temp);
    583     load32(Address(temp, offset), resultPayload);
    584     load32(Address(temp, offset + 4), resultTag);
     583    load32(Address(temp, offset + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
     584    load32(Address(temp, offset + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
    585585}
    586586
    … …  
    629629    storePtr(ImmPtr(newStructure), Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)));
    630630   
    631     load32(Address(stackPointerRegister, OBJECT_OFFSETOF(JITStackFrame, args[2]) + sizeof(void*)), regT3);
    632     load32(Address(stackPointerRegister, OBJECT_OFFSETOF(JITStackFrame, args[2]) + sizeof(void*) + 4), regT2);
     631    load32(Address(stackPointerRegister, OBJECT_OFFSETOF(JITStackFrame, args[2]) + sizeof(void*) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT3);
     632    load32(Address(stackPointerRegister, OBJECT_OFFSETOF(JITStackFrame, args[2]) + sizeof(void*) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT2);
    633633   
    634634    // Write the value
    … …  
    674674    // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
    675675    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetGetByIdStructure), structure);
    676     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset1), offset); // payload
    677     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset2), offset + 4); // tag
     676    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset1), offset + OBJECT_OFFSETOF(JSValue, u.asBits.payload)); // payload
     677    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset2), offset + OBJECT_OFFSETOF(JSValue, u.asBits.tag)); // tag
    678678}
    679679
    … …  
    715715    // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
    716716    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetPutByIdStructure), structure);
    717     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset1), offset); // payload
    718     repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset2), offset + 4); // tag
     717    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset1), offset + OBJECT_OFFSETOF(JSValue, u.asBits.payload)); // payload
     718    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset2), offset + OBJECT_OFFSETOF(JSValue, u.asBits.tag)); // tag
    719719}
    720720
    … …  
    11231123   
    11241124    Jump notUsingInlineStorage = branch32(NotEqual, Address(structure, OBJECT_OFFSETOF(Structure, m_propertyStorageCapacity)), Imm32(JSObject::inlineStorageCapacity));
    1125     loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
    1126     loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage)+OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
     1125    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayload);
     1126    loadPtr(BaseIndex(base, offset, TimesEight, OBJECT_OFFSETOF(JSObject, m_inlineStorage) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTag);
    11271127    Jump finishedLoad = jump();
    11281128    notUsingInlineStorage.link(this);
Note: See TracChangeset for help on using the changeset viewer.