JIT thunks should work on arm64_32

https://bugs.webkit.org/show_bug.cgi?id=213103

Reviewed by Saam Barati.

JSTests:

skip test on memory limited since it breaks on watch with JIT.

* stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:

Source/JavaScriptCore:

This patch fixes various issues when running JSC on arm64_32 with
useJIT=1 and useBaselineJIT=0. In particular this patch makes the
following changes:

1) ScalePtr is now just part of the Scale enum and is set based on
the size of the address space.

2) MacroAssembler::*Ptr functions call 32/64 bit variants based on
Address space size rather than cpu architecture. Vetting of callsites
using Ptr as 64 will happen in future patches since it's hard to
comprehensively vet.

3) Add some missing variants of functions for when pointers are 32-bit.

4) Add a load/storeReg function that stores a full register regardless
of pointer size for storing/loading callee saves.

5) numberOfDFGCompiles should report a big number for
useBaselineJIT=0 as some tests fail by default if useBaselineJIT=0
but useJIT=1.

6) Assert BaseIndex has a scale of PtrSize or TimesOne (for pre-scaled
values) when passed to a load/storePtr function.

* assembler/AbstractMacroAssembler.h:
(JSC::AbstractMacroAssembler::timesPtr): Deleted.
* assembler/MacroAssembler.h:
(JSC::MacroAssembler::rotateRightPtr):
(JSC::MacroAssembler::loadPtr):
(JSC::MacroAssembler::loadPtrWithCompactAddressOffsetPatch):
(JSC::MacroAssembler::branchPtr):
(JSC::MacroAssembler::storePtr):
(JSC::MacroAssembler::shouldBlindDouble):
(JSC::MacroAssembler::moveDouble):
(JSC::MacroAssembler::store64):
* assembler/MacroAssemblerARM64.h:
(JSC::MacroAssemblerARM64::add32):
(JSC::MacroAssemblerARM64::signExtend32ToPtr):
(JSC::MacroAssemblerARM64::loadPtr):
(JSC::MacroAssemblerARM64::call):
(JSC::MacroAssemblerARM64::farJump):
* assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::rotateRight32):
* assembler/MacroAssemblerMIPS.h:
(JSC::MacroAssemblerMIPS::rotateRight32):
* assembler/MacroAssemblerX86.h:
* assembler/MacroAssemblerX86_64.h:
* b3/B3LowerMacros.cpp:
* b3/testb3_6.cpp:
(testInterpreter):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::emitLoadStructure):
(JSC::AssemblyHelpers::emitAllocateVariableSized):
(JSC::AssemblyHelpers::restoreCalleeSavesFromEntryFrameCalleeSavesBuffer):
(JSC::AssemblyHelpers::copyCalleeSavesToEntryFrameCalleeSavesBufferImpl):
* jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::storeReg):
(JSC::AssemblyHelpers::loadReg):
(JSC::AssemblyHelpers::emitMaterializeTagCheckRegisters):
(JSC::AssemblyHelpers::emitGetFromCallFrameHeaderPtr):
(JSC::AssemblyHelpers::emitGetFromCallFrameHeader32):
(JSC::AssemblyHelpers::emitGetFromCallFrameHeader64):
(JSC::AssemblyHelpers::emitPutToCallFrameHeader):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_enumerator_structure_pname):
(JSC::JIT::emit_op_enumerator_generic_pname):
* jit/ThunkGenerators.cpp:
(JSC::nativeForGenerator):
* runtime/TestRunnerUtils.cpp:
(JSC::numberOfDFGCompiles):

Source/WebCore:

Refactor timesPtr() to ScalePtr.

* cssjit/SelectorCompiler.cpp:
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementHasClasses):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@263049 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Author: [email protected]

JSTests/ChangeLog

@@ -1,3 +1,14 @@
+2020-06-15  Keith Miller  <[email protected]>
+
+        JIT thunks should work on arm64_32
+        https://bugs.webkit.org/show_bug.cgi?id=213103
+
+        Reviewed by Saam Barati.
+
+        skip test on memory limited since it breaks on watch with JIT.
+
+        * stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js:
+
 2020-06-15  Caitlin Potter  <[email protected]>
 
         [JSC] add machinery to disable JIT tiers when experimental features are enabled

JSTests/stress/array-buffer-view-watchpoint-can-be-fired-in-really-add-in-dfg.js

@@ -1,3 +1,4 @@
+//@ skip if $memoryLimited
 //@ skip if ["arm", "powerpc", "powerpc64", "s390"].include?($architecture) and $hostOS == "linux"
 //@ requireOptions("-e", "let iterations=40000") if ["mips"].include?($architecture)
 //@ runDefault("--jitPolicyScale=0")

Source/JavaScriptCore/ChangeLog

@@ -1,3 +1,83 @@
+2020-06-15  Keith Miller  <[email protected]>
+
+        JIT thunks should work on arm64_32
+        https://bugs.webkit.org/show_bug.cgi?id=213103
+
+        Reviewed by Saam Barati.
+
+        This patch fixes various issues when running JSC on arm64_32 with
+        useJIT=1 and useBaselineJIT=0. In particular this patch makes the
+        following changes:
+
+        1) ScalePtr is now just part of the Scale enum and is set based on
+        the size of the address space.
+
+        2) MacroAssembler::*Ptr functions call 32/64 bit variants based on
+        Address space size rather than cpu architecture. Vetting of callsites
+        using Ptr as 64 will happen in future patches since it's hard to
+        comprehensively vet.
+
+        3) Add some missing variants of functions for when pointers are 32-bit.
+
+        4) Add a load/storeReg function that stores a full register regardless
+        of pointer size for storing/loading callee saves.
+
+        5) numberOfDFGCompiles should report a big number for
+        useBaselineJIT=0 as some tests fail by default if useBaselineJIT=0
+        but useJIT=1.
+
+        6) Assert BaseIndex has a scale of PtrSize or TimesOne (for pre-scaled
+        values) when passed to a load/storePtr function.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::timesPtr): Deleted.
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::rotateRightPtr):
+        (JSC::MacroAssembler::loadPtr):
+        (JSC::MacroAssembler::loadPtrWithCompactAddressOffsetPatch):
+        (JSC::MacroAssembler::branchPtr):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::shouldBlindDouble):
+        (JSC::MacroAssembler::moveDouble):
+        (JSC::MacroAssembler::store64):
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::add32):
+        (JSC::MacroAssemblerARM64::signExtend32ToPtr):
+        (JSC::MacroAssemblerARM64::loadPtr):
+        (JSC::MacroAssemblerARM64::call):
+        (JSC::MacroAssemblerARM64::farJump):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::rotateRight32):
+        * assembler/MacroAssemblerMIPS.h:
+        (JSC::MacroAssemblerMIPS::rotateRight32):
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86_64.h:
+        * b3/B3LowerMacros.cpp:
+        * b3/testb3_6.cpp:
+        (testInterpreter):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
+        * jit/AssemblyHelpers.cpp:
+        (JSC::AssemblyHelpers::emitLoadStructure):
+        (JSC::AssemblyHelpers::emitAllocateVariableSized):
+        (JSC::AssemblyHelpers::restoreCalleeSavesFromEntryFrameCalleeSavesBuffer):
+        (JSC::AssemblyHelpers::copyCalleeSavesToEntryFrameCalleeSavesBufferImpl):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::storeReg):
+        (JSC::AssemblyHelpers::loadReg):
+        (JSC::AssemblyHelpers::emitMaterializeTagCheckRegisters):
+        (JSC::AssemblyHelpers::emitGetFromCallFrameHeaderPtr):
+        (JSC::AssemblyHelpers::emitGetFromCallFrameHeader32):
+        (JSC::AssemblyHelpers::emitGetFromCallFrameHeader64):
+        (JSC::AssemblyHelpers::emitPutToCallFrameHeader):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_enumerator_structure_pname):
+        (JSC::JIT::emit_op_enumerator_generic_pname):
+        * jit/ThunkGenerators.cpp:
+        (JSC::nativeForGenerator):
+        * runtime/TestRunnerUtils.cpp:
+        (JSC::numberOfDFGCompiles):
+
 2020-06-15  Caitlin Potter  <[email protected]>
 
         [JSC] add machinery to disable JIT tiers when experimental features are enabled

Source/JavaScriptCore/assembler/AbstractMacroAssembler.h

@@ -120,15 +120,9 @@ class AbstractMacroAssembler : public AbstractMacroAssemblerBase {
         TimesTwo,
         TimesFour,
         TimesEight,
+        ScalePtr = isAddress64Bit() ? TimesEight : TimesFour,
     };
 
-    static Scale timesPtr()
-    {
-        if (sizeof(void*) == 4)
-            return TimesFour;
-        return TimesEight;
-    }
-    
     struct BaseIndex;
 
     static RegisterID withSwappedRegister(RegisterID original, RegisterID left, RegisterID right)

Source/JavaScriptCore/assembler/MacroAssembler.h

@@ -95,6 +95,7 @@ using MacroAssemblerBase = TARGET_MACROASSEMBLER;
 
 class MacroAssembler : public MacroAssemblerBase {
 public:
+    using Base = MacroAssemblerBase;
 
     static constexpr RegisterID nextRegister(RegisterID reg)
     {
@@ -150,6 +151,12 @@ class MacroAssembler : public MacroAssemblerBase {
     using MacroAssemblerBase::urshift32;
     using MacroAssemblerBase::xor32;
 
+#if CPU(ARM64) || CPU(X86_64)
+    using MacroAssemblerBase::and64;
+    using MacroAssemblerBase::convertInt32ToDouble;
+    using MacroAssemblerBase::store64;
+#endif
+
     static bool isPtrAlignedAddressOffset(ptrdiff_t value)
     {
         return value == static_cast<int32_t>(value);
@@ -541,8 +548,7 @@ class MacroAssembler : public MacroAssemblerBase {
 
     // Ptr methods
     // On 32-bit platforms (i.e. x86), these methods directly map onto their 32-bit equivalents.
-    // FIXME: should this use a test for 32-bitness instead of this specific exception?
-#if !CPU(X86_64) && !CPU(ARM64)
+#if !CPU(ADDRESS64)
     void addPtr(Address src, RegisterID dest)
     {
         add32(src, dest);
@@ -658,6 +664,11 @@ class MacroAssembler : public MacroAssemblerBase {
         or32(imm, dest);
     }
 
+    void rotateRightPtr(TrustedImm32 imm, RegisterID srcDst)
+    {
+        rotateRight32(imm, srcDst);
+    }
+
     void subPtr(RegisterID src, RegisterID dest)
     {
         sub32(src, dest);
@@ -700,6 +711,7 @@ class MacroAssembler : public MacroAssemblerBase {
 
     void loadPtr(BaseIndex address, RegisterID dest)
     {
+        ASSERT(address.scale == ScalePtr || address.scale == TimesOne);
         load32(address, dest);
     }
 
@@ -729,11 +741,6 @@ class MacroAssembler : public MacroAssemblerBase {
     {
         return load32WithCompactAddressOffsetPatch(address, dest);
     }
-
-    void move(ImmPtr imm, RegisterID dest)
-    {
-        move(Imm32(imm.asTrustedImmPtr()), dest);
-    }
 
     void comparePtr(RelationalCondition cond, RegisterID left, TrustedImm32 right, RegisterID dest)
     {
@@ -870,7 +877,7 @@ class MacroAssembler : public MacroAssemblerBase {
         return MacroAssemblerBase::branchTest8(cond, Address(address.base, address.offset), mask);
     }
 
-#else // !CPU(X86_64) && !CPU(ARM64)
+#else // !CPU(ADDRESS64)
 
     void addPtr(RegisterID src, RegisterID dest)
     {
@@ -1050,6 +1057,7 @@ class MacroAssembler : public MacroAssemblerBase {
 
     void loadPtr(BaseIndex address, RegisterID dest)
     {
+        ASSERT(address.scale == ScalePtr || address.scale == TimesOne);
         load64(address, dest);
     }
 
@@ -1219,9 +1227,29 @@ class MacroAssembler : public MacroAssemblerBase {
         return branchSub64(cond, src1, src2, dest);
     }
 
-    using MacroAssemblerBase::and64;
-    using MacroAssemblerBase::convertInt32ToDouble;
-    using MacroAssemblerBase::store64;
+    Jump branchPtr(RelationalCondition cond, RegisterID left, ImmPtr right)
+    {
+        if (shouldBlind(right) && haveScratchRegisterForBlinding()) {
+            RegisterID scratchRegister = scratchRegisterForBlinding();
+            loadRotationBlindedConstant(rotationBlindConstant(right), scratchRegister);
+            return branchPtr(cond, left, scratchRegister);
+        }
+        return branchPtr(cond, left, right.asTrustedImmPtr());
+    }
+
+    void storePtr(ImmPtr imm, Address dest)
+    {
+        if (shouldBlind(imm) && haveScratchRegisterForBlinding()) {
+            RegisterID scratchRegister = scratchRegisterForBlinding();
+            loadRotationBlindedConstant(rotationBlindConstant(imm), scratchRegister);
+            storePtr(scratchRegister, dest);
+        } else
+            storePtr(imm.asTrustedImmPtr(), dest);
+    }
+
+#endif // !CPU(ADDRESS64)
+
+#if USE(JSVALUE64)
     bool shouldBlindDouble(double value)
     {
         // Don't trust NaN or +/-Infinity
@@ -1415,13 +1443,11 @@ class MacroAssembler : public MacroAssemblerBase {
             move(imm.asTrustedImm64(), dest);
     }
 
-#if CPU(X86_64) || CPU(ARM64)
     void moveDouble(Imm64 imm, FPRegisterID dest)
     {
         move(imm, scratchRegister());
         move64ToDouble(scratchRegister(), dest);
     }
-#endif
 
     void and64(Imm32 imm, RegisterID dest)
     {
@@ -1432,38 +1458,7 @@ class MacroAssembler : public MacroAssemblerBase {
         } else
             and64(imm.asTrustedImm32(), dest);
     }
-
-    Jump branchPtr(RelationalCondition cond, RegisterID left, ImmPtr right)
-    {
-        if (shouldBlind(right) && haveScratchRegisterForBlinding()) {
-            RegisterID scratchRegister = scratchRegisterForBlinding();
-            loadRotationBlindedConstant(rotationBlindConstant(right), scratchRegister);
-            return branchPtr(cond, left, scratchRegister);
-        }
-        return branchPtr(cond, left, right.asTrustedImmPtr());
-    }
-    
-    void storePtr(ImmPtr imm, Address dest)
-    {
-        if (shouldBlind(imm) && haveScratchRegisterForBlinding()) {
-            RegisterID scratchRegister = scratchRegisterForBlinding();
-            loadRotationBlindedConstant(rotationBlindConstant(imm), scratchRegister);
-            storePtr(scratchRegister, dest);
-        } else
-            storePtr(imm.asTrustedImmPtr(), dest);
-    }
-
-    void store64(Imm64 imm, Address dest)
-    {
-        if (shouldBlind(imm) && haveScratchRegisterForBlinding()) {
-            RegisterID scratchRegister = scratchRegisterForBlinding();
-            loadRotationBlindedConstant(rotationBlindConstant(imm), scratchRegister);
-            store64(scratchRegister, dest);
-        } else
-            store64(imm.asTrustedImm64(), dest);
-    }
-
-#endif // !CPU(X86_64)
+#endif // USE(JSVALUE64)
 
 #if !CPU(X86) && !CPU(X86_64) && !CPU(ARM64)
     // We should implement this the right way eventually, but for now, it's fine because it arises so
@@ -1719,7 +1714,18 @@ class MacroAssembler : public MacroAssemblerBase {
     {
         store64(value, addressForPoke(index));
     }
-#endif // CPU(X86_64)
+
+    void store64(Imm64 imm, Address dest)
+    {
+        if (shouldBlind(imm) && haveScratchRegisterForBlinding()) {
+            RegisterID scratchRegister = scratchRegisterForBlinding();
+            loadRotationBlindedConstant(rotationBlindConstant(imm), scratchRegister);
+            store64(scratchRegister, dest);
+        } else
+            store64(imm.asTrustedImm64(), dest);
+    }
+
+#endif // CPU(X86_64) || CPU(ARM64)
 
     void store32(Imm32 imm, Address dest)
     {