Attachment 304587 Details for Bug 169611 – patch

[patch] patch

0001-wasm-tls.patch (text/plain), 41.73 KB, created by JF Bastien on 2017-03-15 17:32:18 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: JF Bastien

Created: 2017-03-15 17:32:18 PDT

Size: 41.73 KB

patch

obsolete

>From e8e6c3dd6a8310abbae5eb5f2d1742adb309dcab Mon Sep 17 00:00:00 2001
>From: JF Bastien <jfbastien@apple.com>
>Date: Tue, 14 Mar 2017 10:39:06 -0700
>Subject: [PATCH] wasm-tls
>
>---
> Source/JavaScriptCore/CMakeLists.txt               |   1 +
> Source/JavaScriptCore/ChangeLog                    |  67 +++++++++++
> .../JavaScriptCore.xcodeproj/project.pbxproj       |  12 +-
> Source/JavaScriptCore/assembler/MacroAssembler.h   |   8 ++
> .../JavaScriptCore/assembler/MacroAssemblerARM64.h |  20 +++-
> .../assembler/MacroAssemblerX86Common.h            |   5 +
> .../assembler/MacroAssemblerX86_64.h               |   7 +-
> Source/JavaScriptCore/assembler/X86Assembler.h     |  10 ++
> Source/JavaScriptCore/b3/testb3.cpp                |  31 ++++-
> Source/JavaScriptCore/jit/Repatch.cpp              |   9 +-
> Source/JavaScriptCore/jit/ThunkGenerators.cpp      |   3 +-
> Source/JavaScriptCore/runtime/VM.cpp               |   1 -
> Source/JavaScriptCore/runtime/VM.h                 |   2 -
> Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp   |  32 +++---
> Source/JavaScriptCore/wasm/WasmBinding.cpp         |  17 +--
> Source/JavaScriptCore/wasm/WasmTop.cpp             | 128 +++++++++++++++++++++
> Source/JavaScriptCore/wasm/WasmTop.h               |  60 ++++++++++
> .../JavaScriptCore/wasm/js/WebAssemblyFunction.cpp |   8 +-
> .../wasm/js/WebAssemblyInstanceConstructor.h       |   1 +
> Source/WTF/ChangeLog                               |  11 ++
> Source/WTF/wtf/FastTLS.h                           |  39 +------
> 21 files changed, 395 insertions(+), 77 deletions(-)
> create mode 100644 Source/JavaScriptCore/wasm/WasmTop.cpp
> create mode 100644 Source/JavaScriptCore/wasm/WasmTop.h
>
>diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
>index f4bf881..4f1f7cf 100644
>--- a/Source/JavaScriptCore/CMakeLists.txt
>+++ b/Source/JavaScriptCore/CMakeLists.txt
>@@ -939,6 +939,7 @@ set(JavaScriptCore_SOURCES
>     wasm/WasmPageCount.cpp
>     wasm/WasmPlan.cpp
>     wasm/WasmSignature.cpp
>+    wasm/WasmTop.cpp
>     wasm/WasmValidate.cpp
> 
>     wasm/js/JSWebAssemblyCallee.cpp
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 88fa81d..dadb264 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,70 @@
>+2017-03-15  JF Bastien  <jfbastien@apple.com>
>+
>+        WebAssembly: store state in TLS instead of on VM
>+        https://bugs.webkit.org/show_bug.cgi?id=169611
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Using thread-local storage instead of VM makes code more position
>+        independent. This means we'll be able to postMessage and
>+        structured clone into IDB without having to recompile the
>+        code. This wasn't possible before because we hard-coded the
>+        address of VM at compilation time. That doesn't work between
>+        workers, and doesn't work across reloads (which IDB is intended to
>+        do).
>+
>+        It'll also potentially make code faster once we start tuning
>+        what's in TLS, what's in which of the 4 free slots, and what's in
>+        pinned registers. I'm leaving this tuning for later because
>+        there's lower lying fruit for us to pick.
>+
>+        * CMakeLists.txt:
>+        * JavaScriptCore.xcodeproj/project.pbxproj:
>+        * assembler/MacroAssembler.h:
>+        (JSC::MacroAssembler::storeToTLSPtr): we previously didn't have
>+        the code required to store to TLS, only to load
>+        * assembler/MacroAssemblerARM64.h:
>+        (JSC::MacroAssemblerARM64::storeToTLS32):
>+        (JSC::MacroAssemblerARM64::storeToTLS64):
>+        * assembler/MacroAssemblerX86Common.h:
>+        (JSC::MacroAssemblerX86Common::storeToTLS32):
>+        * assembler/MacroAssemblerX86_64.h:
>+        (JSC::MacroAssemblerX86_64::loadFromTLS64): was loading 32-bit instead of 64-bit
>+        (JSC::MacroAssemblerX86_64::storeToTLS64):
>+        * assembler/X86Assembler.h:
>+        (JSC::X86Assembler::movl_rm):
>+        (JSC::X86Assembler::movq_rm):
>+        * b3/testb3.cpp:
>+        (JSC::B3::testFastTLSLoad):
>+        (JSC::B3::testFastTLSStore):
>+        (JSC::B3::run):
>+        * jit/Repatch.cpp:
>+        (JSC::webAssemblyOwner):
>+        (JSC::linkFor):
>+        (JSC::linkPolymorphicCall):
>+        * jit/ThunkGenerators.cpp:
>+        (JSC::throwExceptionFromWasmThunkGenerator):
>+        * runtime/VM.cpp:
>+        (JSC::VM::VM):
>+        * runtime/VM.h:
>+        * wasm/WasmB3IRGenerator.cpp:
>+        (JSC::Wasm::B3IRGenerator::B3IRGenerator):
>+        (JSC::Wasm::getMemoryBaseAndSize):
>+        (JSC::Wasm::restoreWebAssemblyGlobalState):
>+        (JSC::Wasm::createJSToWasmWrapper):
>+        (JSC::Wasm::parseAndCompile):
>+        * wasm/WasmBinding.cpp:
>+        (JSC::Wasm::materializeImportJSCell):
>+        (JSC::Wasm::wasmToJs):
>+        (JSC::Wasm::wasmToWasm):
>+        * wasm/WasmTop.cpp: Added. Handle all "Top" wasm state here for consistency.
>+        (JSC::WasmTop::load):
>+        (JSC::WasmTop::store):
>+        * wasm/WasmTop.h: Added.
>+        * wasm/js/WebAssemblyFunction.cpp:
>+        (JSC::callWebAssemblyFunction):
>+        * wasm/js/WebAssemblyInstanceConstructor.h:
>+
> 2017-03-11  Filip Pizlo  <fpizlo@apple.com>
> 
>         Structure::willStoreValueSlow needs to keep the property table alive until the end
>diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>index 09200ba..d60c9fc 100644
>--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>@@ -2079,6 +2079,8 @@
> 		AD2FCC301DB83D4900B3E736 /* JSWebAssembly.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCC2E1DB839F700B3E736 /* JSWebAssembly.cpp */; };
> 		AD2FCC311DB83D4900B3E736 /* JSWebAssembly.h in Headers */ = {isa = PBXBuildFile; fileRef = AD2FCC2F1DB839F700B3E736 /* JSWebAssembly.h */; };
> 		AD2FCC331DC4045400B3E736 /* WasmFormat.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD2FCC321DC4045300B3E736 /* WasmFormat.cpp */; };
>+		AD412B2E1E78653F008AF157 /* WasmTop.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD412B2C1E786523008AF157 /* WasmTop.cpp */; };
>+		AD412B2F1E786542008AF157 /* WasmTop.h in Headers */ = {isa = PBXBuildFile; fileRef = AD412B2D1E786523008AF157 /* WasmTop.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		AD4252511E5D0E14009D2A97 /* FullCodeOrigin.h in Headers */ = {isa = PBXBuildFile; fileRef = AD4252501E5D0DEB009D2A97 /* FullCodeOrigin.h */; };
> 		AD4252531E5D0F47009D2A97 /* FullCodeOrigin.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD4252521E5D0F22009D2A97 /* FullCodeOrigin.cpp */; };
> 		AD4937C31DDBE6140077C807 /* AbstractModuleRecord.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AD4937C11DDBE60A0077C807 /* AbstractModuleRecord.cpp */; };
>@@ -4644,6 +4646,8 @@
> 		AD2FCC2E1DB839F700B3E736 /* JSWebAssembly.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebAssembly.cpp; sourceTree = "<group>"; };
> 		AD2FCC2F1DB839F700B3E736 /* JSWebAssembly.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebAssembly.h; sourceTree = "<group>"; };
> 		AD2FCC321DC4045300B3E736 /* WasmFormat.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmFormat.cpp; sourceTree = "<group>"; };
>+		AD412B2C1E786523008AF157 /* WasmTop.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmTop.cpp; sourceTree = "<group>"; };
>+		AD412B2D1E786523008AF157 /* WasmTop.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmTop.h; sourceTree = "<group>"; };
> 		AD4252501E5D0DEB009D2A97 /* FullCodeOrigin.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FullCodeOrigin.h; sourceTree = "<group>"; };
> 		AD4252521E5D0F22009D2A97 /* FullCodeOrigin.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FullCodeOrigin.cpp; sourceTree = "<group>"; };
> 		AD4937C11DDBE60A0077C807 /* AbstractModuleRecord.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AbstractModuleRecord.cpp; sourceTree = "<group>"; };
>@@ -6245,6 +6249,8 @@
> 				53FD04D11D7AB187003287D3 /* WasmCallingConvention.cpp */,
> 				53FD04D21D7AB187003287D3 /* WasmCallingConvention.h */,
> 				79DAE2791E03C82200B526AA /* WasmExceptionType.h */,
>+				5381B9361E60E9660090F794 /* WasmFaultSignalHandler.cpp */,
>+				5381B9381E60E97D0090F794 /* WasmFaultSignalHandler.h */,
> 				AD2FCC321DC4045300B3E736 /* WasmFormat.cpp */,
> 				7BC547D21B69599B00959B58 /* WasmFormat.h */,
> 				53F40E8A1D5901BB0099A1B6 /* WasmFunctionParser.h */,
>@@ -6255,8 +6261,6 @@
> 				53F40E961D5A7BEC0099A1B6 /* WasmModuleParser.cpp */,
> 				53F40E941D5A7AEF0099A1B6 /* WasmModuleParser.h */,
> 				ADB6F67C1E15D7500082F384 /* WasmPageCount.cpp */,
>-				5381B9361E60E9660090F794 /* WasmFaultSignalHandler.cpp */,
>-				5381B9381E60E97D0090F794 /* WasmFaultSignalHandler.h */,
> 				79B759731DFA4C600052174C /* WasmPageCount.h */,
> 				53F40E8C1D5901F20099A1B6 /* WasmParser.h */,
> 				531374BE1D5CE95000AF7A0B /* WasmPlan.cpp */,
>@@ -6264,6 +6268,8 @@
> 				53F40E841D58F9770099A1B6 /* WasmSections.h */,
> 				AD7438BE1E04579200FD0C2A /* WasmSignature.cpp */,
> 				AD7438BF1E04579200FD0C2A /* WasmSignature.h */,
>+				AD412B2C1E786523008AF157 /* WasmTop.cpp */,
>+				AD412B2D1E786523008AF157 /* WasmTop.h */,
> 				53FF7F9A1DBFD2B900A26CCC /* WasmValidate.cpp */,
> 				53FF7F981DBFCD9000A26CCC /* WasmValidate.h */,
> 			);
>@@ -9272,6 +9278,7 @@
> 				A7A8AF3F17ADB5F3005AB174 /* Uint8Array.h in Headers */,
> 				A7A8AF4017ADB5F3005AB174 /* Uint8ClampedArray.h in Headers */,
> 				0F5F08CF146C7633000472A9 /* UnconditionalFinalizer.h in Headers */,
>+				AD412B2F1E786542008AF157 /* WasmTop.h in Headers */,
> 				A7B601821639FD2A00372BA3 /* UnlinkedCodeBlock.h in Headers */,
> 				14AD91241DCA9FA40014F9FE /* UnlinkedEvalCodeBlock.h in Headers */,
> 				14AD91231DCA9FA40014F9FE /* UnlinkedFunctionCodeBlock.h in Headers */,
>@@ -10195,6 +10202,7 @@
> 				0F893BDB1936E23C001211F4 /* DFGStructureAbstractValue.cpp in Sources */,
> 				0F2FCCFE18A60070001A27F8 /* DFGThreadData.cpp in Sources */,
> 				0FC097A1146B28CA00CF2442 /* DFGThunks.cpp in Sources */,
>+				AD412B2E1E78653F008AF157 /* WasmTop.cpp in Sources */,
> 				0FD8A32717D51F5700CA2C40 /* DFGTierUpCheckInjectionPhase.cpp in Sources */,
> 				0FD8A32917D51F5700CA2C40 /* DFGToFTLDeferredCompilationCallback.cpp in Sources */,
> 				0FD8A32B17D51F5700CA2C40 /* DFGToFTLForOSREntryDeferredCompilationCallback.cpp in Sources */,
>diff --git a/Source/JavaScriptCore/assembler/MacroAssembler.h b/Source/JavaScriptCore/assembler/MacroAssembler.h
>index ddfc928..a21582d 100644
>--- a/Source/JavaScriptCore/assembler/MacroAssembler.h
>+++ b/Source/JavaScriptCore/assembler/MacroAssembler.h
>@@ -632,6 +632,10 @@ public:
>     {
>         loadFromTLS32(offset, dst);
>     }
>+    void storeToTLSPtr(RegisterID src, uint32_t offset)
>+    {
>+        storeToTLS32(src, offset);
>+    }
> #endif
> 
>     DataLabel32 loadPtrWithAddressOffsetPatch(Address address, RegisterID dest)
>@@ -946,6 +950,10 @@ public:
>     {
>         loadFromTLS64(offset, dst);
>     }
>+    void storeToTLSPtr(RegisterID src, uint32_t offset)
>+    {
>+        storeToTLS64(src, offset);
>+    }
> #endif
> 
>     DataLabel32 loadPtrWithAddressOffsetPatch(Address address, RegisterID dest)
>diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h b/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
>index 7f8b65d..16c02e9 100644
>--- a/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
>+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
>@@ -3600,7 +3600,7 @@ public:
>     
> #if ENABLE(FAST_TLS_JIT)
>     // This will use scratch registers if the offset is not legal.
>-    
>+
>     void loadFromTLS32(uint32_t offset, RegisterID dst)
>     {
>         m_assembler.mrs_TPIDRRO_EL0(dst);
>@@ -3614,6 +3614,24 @@ public:
>         and64(TrustedImm32(~7), dst);
>         load64(Address(dst, offset), dst);
>     }
>+
>+    void storeToTLS32(RegisterID src, uint32_t offset)
>+    {
>+        RegisterID tmp = getCachedDataTempRegisterIDAndInvalidate();
>+        ASSERT(src != tmp);
>+        m_assembler.mrs_TPIDRRO_EL0(tmp);
>+        and64(TrustedImm32(~7), tmp);
>+        store32(src, Address(tmp, offset));
>+    }
>+    
>+    void storeToTLS64(RegisterID src, uint32_t offset)
>+    {
>+        RegisterID tmp = getCachedDataTempRegisterIDAndInvalidate();
>+        ASSERT(src != tmp);
>+        m_assembler.mrs_TPIDRRO_EL0(tmp);
>+        and64(TrustedImm32(~7), tmp);
>+        store64(src, Address(tmp, offset));
>+    }
> #endif // ENABLE(FAST_TLS_JIT)
>     
>     // Misc helper functions.
>diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
>index 15b220c..030d809 100644
>--- a/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
>+++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
>@@ -3864,6 +3864,11 @@ public:
>         m_assembler.gs();
>         m_assembler.movl_mr(offset, dst);
>     }
>+    void storeToTLS32(RegisterID src, uint32_t offset)
>+    {
>+        m_assembler.gs();
>+        m_assembler.movl_rm(src, offset);
>+    }
> #endif
> 
>     static void replaceWithBreakpoint(CodeLocationLabel instructionStart)
>diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h b/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
>index bc34a0d..a91f608 100644
>--- a/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
>+++ b/Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
>@@ -1705,7 +1705,12 @@ public:
>     void loadFromTLS64(uint32_t offset, RegisterID dst)
>     {
>         m_assembler.gs();
>-        m_assembler.movl_mr(offset, dst);
>+        m_assembler.movq_mr(offset, dst);
>+    }
>+    void storeToTLS64(RegisterID src, uint32_t offset)
>+    {
>+        m_assembler.gs();
>+        m_assembler.movq_rm(src, offset);
>     }
> #endif
> 
>diff --git a/Source/JavaScriptCore/assembler/X86Assembler.h b/Source/JavaScriptCore/assembler/X86Assembler.h
>index a4c8e32..343022e 100644
>--- a/Source/JavaScriptCore/assembler/X86Assembler.h
>+++ b/Source/JavaScriptCore/assembler/X86Assembler.h
>@@ -2360,6 +2360,11 @@ public:
>         m_formatter.oneByteOpAddr(OP_MOV_GvEv, dst, addr);
>     }
> 
>+    void movl_rm(RegisterID src, uint32_t addr)
>+    {
>+        m_formatter.oneByteOpAddr(OP_MOV_EvGv, src, addr);
>+    }
>+
> #if CPU(X86_64)
>     void movq_rr(RegisterID src, RegisterID dst)
>     {
>@@ -2381,6 +2386,11 @@ public:
>         m_formatter.oneByteOp64(OP_MOV_EvGv, src, base, index, scale, offset);
>     }
> 
>+    void movq_rm(RegisterID src, int offset)
>+    {
>+        m_formatter.oneByteOp64Addr(OP_MOV_EvGv, src, offset);
>+    }
>+
>     void movq_mEAX(const void* addr)
>     {
>         m_formatter.oneByteOp64(OP_MOV_EAXOv);
>diff --git a/Source/JavaScriptCore/b3/testb3.cpp b/Source/JavaScriptCore/b3/testb3.cpp
>index c4cbe18..5a55b4d 100644
>--- a/Source/JavaScriptCore/b3/testb3.cpp
>+++ b/Source/JavaScriptCore/b3/testb3.cpp
>@@ -15211,7 +15211,7 @@ void testWasmAddress()
>         CHECK_EQ(numToStore, value);
> }
> 
>-void testFastTLS()
>+void testFastTLSLoad()
> {
> #if ENABLE(FAST_TLS_JIT)
>     _pthread_setspecific_direct(WTF_TESTING_KEY, bitwise_cast<void*>(static_cast<uintptr_t>(0xbeef)));
>@@ -15226,13 +15226,37 @@ void testFastTLS()
>             AllowMacroScratchRegisterUsage allowScratch(jit);
>             jit.loadFromTLSPtr(fastTLSOffsetForKey(WTF_TESTING_KEY), params[0].gpr());
>         });
>-    
>+
>     root->appendNew<Value>(proc, Return, Origin(), patchpoint);
>     
>     CHECK_EQ(compileAndRun<uintptr_t>(proc), static_cast<uintptr_t>(0xbeef));
> #endif
> }
> 
>+void testFastTLSStore()
>+{
>+#if ENABLE(FAST_TLS_JIT)
>+    Procedure proc;
>+    BasicBlock* root = proc.addBlock();
>+
>+    PatchpointValue* patchpoint = root->appendNew<PatchpointValue>(proc, Void, Origin());
>+    patchpoint->clobber(RegisterSet::macroScratchRegisters());
>+    patchpoint->numGPScratchRegisters = 1;
>+    patchpoint->setGenerator(
>+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
>+            AllowMacroScratchRegisterUsage allowScratch(jit);
>+            GPRReg scratch = params.gpScratch(0);
>+            jit.move(CCallHelpers::TrustedImm32(0xdead), scratch);
>+            jit.storeToTLSPtr(scratch, fastTLSOffsetForKey(WTF_TESTING_KEY));
>+        });
>+
>+    root->appendNewControlValue(proc, Return, Origin());
>+
>+    compileAndRun<void>(proc);
>+    CHECK_EQ(bitwise_cast<uintptr_t>(_pthread_getspecific_direct(WTF_TESTING_KEY)), static_cast<uintptr_t>(0xdead));
>+#endif
>+}
>+
> // Make sure the compiler does not try to optimize anything out.
> NEVER_INLINE double zero()
> {
>@@ -16760,7 +16784,8 @@ void run(const char* filter)
>     RUN(testWasmBoundsCheck(std::numeric_limits<unsigned>::max() - 5));
>     RUN(testWasmAddress());
>     
>-    RUN(testFastTLS());
>+    RUN(testFastTLSLoad());
>+    RUN(testFastTLSStore());
> 
>     if (isX86()) {
>         RUN(testBranchBitAndImmFusion(Identity, Int64, 1, Air::BranchTest32, Air::Arg::Tmp));
>diff --git a/Source/JavaScriptCore/jit/Repatch.cpp b/Source/JavaScriptCore/jit/Repatch.cpp
>index 5601b65..af59a98 100644
>--- a/Source/JavaScriptCore/jit/Repatch.cpp
>+++ b/Source/JavaScriptCore/jit/Repatch.cpp
>@@ -59,6 +59,7 @@
> #include "StructureStubClearingWatchpoint.h"
> #include "StructureStubInfo.h"
> #include "ThunkGenerators.h"
>+#include "WasmTop.h"
> #include <wtf/CommaPrinter.h>
> #include <wtf/ListDump.h>
> #include <wtf/StringPrintStream.h>
>@@ -588,11 +589,11 @@ static bool isWebAssemblyToJSCallee(VM& vm, JSCell* callee)
> #endif // ENABLE(WEBASSEMBLY)
> }
> 
>-static JSCell* webAssemblyOwner(VM& vm)
>+static JSCell* webAssemblyOwner()
> {
> #if ENABLE(WEBASSEMBLY)
>     // Each WebAssembly.Instance shares the stubs from their WebAssembly.Module, which are therefore the appropriate owner.
>-    return vm.topJSWebAssemblyInstance->module();
>+    return WasmTop::load()->module();
> #else
>     UNUSED_PARAM(vm);
>     RELEASE_ASSERT_NOT_REACHED();
>@@ -611,7 +612,7 @@ void linkFor(
>     CodeBlock* callerCodeBlock = callerFrame->codeBlock();
> 
>     // WebAssembly -> JS stubs don't have a valid CodeBlock.
>-    JSCell* owner = isWebAssemblyToJSCallee(vm, callerFrame->callee()) ? webAssemblyOwner(vm) : callerCodeBlock;
>+    JSCell* owner = isWebAssemblyToJSCallee(vm, callerFrame->callee()) ? webAssemblyOwner() : callerCodeBlock;
>     ASSERT(owner);
> 
>     ASSERT(!callLinkInfo.isLinked());
>@@ -734,7 +735,7 @@ void linkPolymorphicCall(
>     bool isWebAssembly = isWebAssemblyToJSCallee(vm, callerFrame->callee());
> 
>     // WebAssembly -> JS stubs don't have a valid CodeBlock.
>-    JSCell* owner = isWebAssembly ? webAssemblyOwner(vm) : callerCodeBlock;
>+    JSCell* owner = isWebAssembly ? webAssemblyOwner() : callerCodeBlock;
>     ASSERT(owner);
> 
>     CallVariantList list;
>diff --git a/Source/JavaScriptCore/jit/ThunkGenerators.cpp b/Source/JavaScriptCore/jit/ThunkGenerators.cpp
>index 9a65506..cc5fc33 100644
>--- a/Source/JavaScriptCore/jit/ThunkGenerators.cpp
>+++ b/Source/JavaScriptCore/jit/ThunkGenerators.cpp
>@@ -39,6 +39,7 @@
> #include "JSWebAssemblyRuntimeError.h"
> #include "SpecializedThunkJIT.h"
> #include "WasmExceptionType.h"
>+#include "WasmTop.h"
> #include <wtf/InlineASM.h>
> #include <wtf/StringPrintStream.h>
> #include <wtf/text/StringImpl.h>
>@@ -1156,7 +1157,7 @@ MacroAssemblerCodeRef throwExceptionFromWasmThunkGenerator(VM* vm)
> 
>         {
>             auto throwScope = DECLARE_THROW_SCOPE(*vm);
>-            JSGlobalObject* globalObject = vm->topJSWebAssemblyInstance->globalObject();
>+            JSGlobalObject* globalObject = WasmTop::load()->globalObject();
> 
>             JSWebAssemblyRuntimeError* error = JSWebAssemblyRuntimeError::create(exec, *vm, globalObject->WebAssemblyRuntimeErrorStructure(), Wasm::errorMessageForExceptionType(type));
>             throwException(exec, throwScope, error);
>diff --git a/Source/JavaScriptCore/runtime/VM.cpp b/Source/JavaScriptCore/runtime/VM.cpp
>index 064db20..8511542 100644
>--- a/Source/JavaScriptCore/runtime/VM.cpp
>+++ b/Source/JavaScriptCore/runtime/VM.cpp
>@@ -177,7 +177,6 @@ VM::VM(VMType vmType, HeapType heapType)
>     , clientData(0)
>     , topVMEntryFrame(nullptr)
>     , topCallFrame(CallFrame::noCaller())
>-    , topJSWebAssemblyInstance(nullptr)
>     , m_atomicStringTable(vmType == Default ? wtfThreadData().atomicStringTable() : new AtomicStringTable)
>     , propertyNames(nullptr)
>     , emptyList(new ArgList)
>diff --git a/Source/JavaScriptCore/runtime/VM.h b/Source/JavaScriptCore/runtime/VM.h
>index 144086d..5474090 100644
>--- a/Source/JavaScriptCore/runtime/VM.h
>+++ b/Source/JavaScriptCore/runtime/VM.h
>@@ -103,7 +103,6 @@ class Interpreter;
> class JSCustomGetterSetterFunction;
> class JSGlobalObject;
> class JSObject;
>-class JSWebAssemblyInstance;
> class LLIntOffsetsExtractor;
> class NativeExecutable;
> class RegExpCache;
>@@ -315,7 +314,6 @@ public:
>     // FIXME: This should be a void*, because it might not point to a CallFrame.
>     // https://bugs.webkit.org/show_bug.cgi?id=160441
>     ExecState* topCallFrame { nullptr };
>-    JSWebAssemblyInstance* topJSWebAssemblyInstance;
>     Strong<Structure> structureStructure;
>     Strong<Structure> structureRareDataStructure;
>     Strong<Structure> terminatedExecutionErrorStructure;
>diff --git a/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp b/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp
>index 0a2e5cc..5450f59 100644
>--- a/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp
>+++ b/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -51,6 +51,7 @@
> #include "WasmExceptionType.h"
> #include "WasmFunctionParser.h"
> #include "WasmMemory.h"
>+#include "WasmTop.h"
> #include <wtf/Optional.h>
> 
> void dumpProcedure(void* ptr)
>@@ -270,8 +271,7 @@ B3IRGenerator::B3IRGenerator(VM& vm, const ModuleInformation& info, Procedure& p
> 
>     wasmCallingConvention().setupFrameInPrologue(&compilation->wasmCalleeMoveLocation, m_proc, Origin(), m_currentBlock);
> 
>-    m_instanceValue = m_currentBlock->appendNew<MemoryValue>(m_proc, Load, pointerType(), Origin(),
>-        m_currentBlock->appendNew<ConstPtrValue>(m_proc, Origin(), &m_vm.topJSWebAssemblyInstance));
>+    m_instanceValue = WasmTop::load(m_proc, m_currentBlock);
> }
> 
> struct MemoryBaseAndSize {
>@@ -279,12 +279,12 @@ struct MemoryBaseAndSize {
>     Value* size;
> };
> 
>-static MemoryBaseAndSize getMemoryBaseAndSize(VM& vm, Value* instance, Procedure& proc, BasicBlock* block)
>+static MemoryBaseAndSize getMemoryBaseAndSize(Value* instance, Procedure& proc, BasicBlock* block)
> {
>     Value* memoryObject = block->appendNew<MemoryValue>(proc, Load, pointerType(), Origin(), instance, JSWebAssemblyInstance::offsetOfMemory());
> 
>-    static_assert(sizeof(decltype(vm.topJSWebAssemblyInstance->memory()->memory().memory())) == sizeof(void*), "codegen relies on this size");
>-    static_assert(sizeof(decltype(vm.topJSWebAssemblyInstance->memory()->memory().size())) == sizeof(uint64_t), "codegen relies on this size");
>+    static_assert(sizeof(decltype(WasmTop::load()->memory()->memory().memory())) == sizeof(void*), "codegen relies on this size");
>+    static_assert(sizeof(decltype(WasmTop::load()->memory()->memory().size())) == sizeof(uint64_t), "codegen relies on this size");
>     MemoryBaseAndSize result;
>     result.base = block->appendNew<MemoryValue>(proc, Load, pointerType(), Origin(), memoryObject, JSWebAssemblyMemory::offsetOfMemory());
>     result.size = block->appendNew<MemoryValue>(proc, Load, Int64, Origin(), memoryObject, JSWebAssemblyMemory::offsetOfSize());
>@@ -292,9 +292,9 @@ static MemoryBaseAndSize getMemoryBaseAndSize(VM& vm, Value* instance, Procedure
>     return result;
> }
> 
>-static void restoreWebAssemblyGlobalState(VM& vm, const MemoryInformation& memory, Value* instance, Procedure& proc, BasicBlock* block)
>+static void restoreWebAssemblyGlobalState(const MemoryInformation& memory, Value* instance, Procedure& proc, BasicBlock* block)
> {
>-    block->appendNew<MemoryValue>(proc, Store, Origin(), instance, block->appendNew<ConstPtrValue>(proc, Origin(), &vm.topJSWebAssemblyInstance));
>+    WasmTop::store(proc, block, instance);
> 
>     if (!!memory) {
>         const PinnedRegisterInfo* pinnedRegs = &PinnedRegisterInfo::get();
>@@ -395,7 +395,7 @@ auto B3IRGenerator::addGrowMemory(ExpressionType delta, ExpressionType& result)
>         VM& vm = exec->vm();
>         auto scope = DECLARE_THROW_SCOPE(vm);
> 
>-        JSWebAssemblyInstance* instance = vm.topJSWebAssemblyInstance;
>+        JSWebAssemblyInstance* instance = WasmTop::load();
>         JSWebAssemblyMemory* wasmMemory = instance->memory();
> 
>         if (delta < 0)
>@@ -414,14 +414,14 @@ auto B3IRGenerator::addGrowMemory(ExpressionType delta, ExpressionType& result)
>         m_currentBlock->appendNew<ConstPtrValue>(m_proc, Origin(), bitwise_cast<void*>(growMemory)),
>         m_currentBlock->appendNew<B3::Value>(m_proc, B3::FramePointer, Origin()), delta);
> 
>-    restoreWebAssemblyGlobalState(m_vm, m_info.memory, m_instanceValue, m_proc, m_currentBlock);
>+    restoreWebAssemblyGlobalState(m_info.memory, m_instanceValue, m_proc, m_currentBlock);
> 
>     return { };
> }
> 
> auto B3IRGenerator::addCurrentMemory(ExpressionType& result) -> PartialResult
> {
>-    auto memoryValue = getMemoryBaseAndSize(m_vm, m_instanceValue, m_proc, m_currentBlock);
>+    auto memoryValue = getMemoryBaseAndSize(m_instanceValue, m_proc, m_currentBlock);
> 
>     constexpr uint32_t shiftValue = 16;
>     static_assert(PageCount::pageSize == 1 << shiftValue, "This must hold for the code below to be correct.");
>@@ -901,7 +901,7 @@ auto B3IRGenerator::addCall(uint32_t functionIndex, const Signature* signature,
>         }
> 
>         // The call could have been to another WebAssembly instance, and / or could have modified our Memory.
>-        restoreWebAssemblyGlobalState(m_vm, m_info.memory, m_instanceValue, m_proc, continuation);
>+        restoreWebAssemblyGlobalState(m_info.memory, m_instanceValue, m_proc, continuation);
>     } else {
>         result = wasmCallingConvention().setupCall(m_proc, m_currentBlock, Origin(), args, toB3Type(returnType),
>             [&] (PatchpointValue* patchpoint) {
>@@ -995,7 +995,7 @@ auto B3IRGenerator::addCallIndirect(const Signature* signature, SignatureIndex s
>         });
> 
>     // The call could have been to another WebAssembly instance, and / or could have modified our Memory.
>-    restoreWebAssemblyGlobalState(m_vm, m_info.memory, m_instanceValue, m_proc, m_currentBlock);
>+    restoreWebAssemblyGlobalState(m_info.memory, m_instanceValue, m_proc, m_currentBlock);
> 
>     return { };
> }
>@@ -1037,7 +1037,7 @@ void B3IRGenerator::dump(const Vector<ControlEntry>& controlStack, const Express
>     dataLogLn();
> }
> 
>-static void createJSToWasmWrapper(VM& vm, CompilationContext& compilationContext, WasmInternalFunction& function, const Signature* signature, const ModuleInformation& info)
>+static void createJSToWasmWrapper(CompilationContext& compilationContext, WasmInternalFunction& function, const Signature* signature, const ModuleInformation& info)
> {
>     CCallHelpers& jit = *compilationContext.jsEntrypointJIT;
> 
>@@ -1165,7 +1165,7 @@ static void createJSToWasmWrapper(VM& vm, CompilationContext& compilationContext
> 
>     if (!!info.memory) {
>         GPRReg baseMemory = pinnedRegs.baseMemoryPointer;
>-        jit.loadPtr(&vm.topJSWebAssemblyInstance, baseMemory);
>+        WasmTop::load(jit, baseMemory);
>         jit.loadPtr(CCallHelpers::Address(baseMemory, JSWebAssemblyInstance::offsetOfMemory()), baseMemory);
>         const auto& sizeRegs = pinnedRegs.sizeRegisters;
>         ASSERT(sizeRegs.size() >= 1);
>@@ -1227,7 +1227,7 @@ Expected<std::unique_ptr<WasmInternalFunction>, String> parseAndCompile(VM& vm,
>         result->wasmEntrypoint.calleeSaveRegisters = procedure.calleeSaveRegisters();
>     }
> 
>-    createJSToWasmWrapper(vm, compilationContext, *result, signature, info);
>+    createJSToWasmWrapper(compilationContext, *result, signature, info);
>     return WTFMove(result);
> }
> 
>diff --git a/Source/JavaScriptCore/wasm/WasmBinding.cpp b/Source/JavaScriptCore/wasm/WasmBinding.cpp
>index cbb3f99..dfcc326 100644
>--- a/Source/JavaScriptCore/wasm/WasmBinding.cpp
>+++ b/Source/JavaScriptCore/wasm/WasmBinding.cpp
>@@ -37,15 +37,16 @@
> #include "NativeErrorConstructor.h"
> #include "WasmCallingConvention.h"
> #include "WasmExceptionType.h"
>+#include "WasmTop.h"
> 
> namespace JSC { namespace Wasm {
> 
> typedef CCallHelpers JIT;
> 
>-static void materializeImportJSCell(VM* vm, JIT& jit, unsigned importIndex, GPRReg result)
>+static void materializeImportJSCell(JIT& jit, unsigned importIndex, GPRReg result)
> {
>-    // We're calling out of the current WebAssembly.Instance, which is identified on VM. That Instance has a list of all its import functions.
>-    jit.loadPtr(&vm->topJSWebAssemblyInstance, result);
>+    // We're calling out of the current WebAssembly.Instance. That Instance has a list of all its import functions.
>+    WasmTop::load(jit, result);
>     jit.loadPtr(JIT::Address(result, JSWebAssemblyInstance::offsetOfImportFunction(importIndex)), result);
> }
> 
>@@ -101,7 +102,7 @@ static MacroAssemblerCodeRef wasmToJs(VM* vm, Bag<CallLinkInfo>& callLinkInfos,
> 
>                 {
>                     auto throwScope = DECLARE_THROW_SCOPE(*vm);
>-                    JSGlobalObject* globalObject = vm->topJSWebAssemblyInstance->globalObject();
>+                    JSGlobalObject* globalObject = WasmTop::load()->globalObject();
>                     auto* error = ErrorInstance::create(exec, *vm, globalObject->typeErrorConstructor()->errorStructure(), ASCIILiteral("i64 not allowed as return type or argument to an imported function"));
>                     throwException(exec, throwScope, error);
>                 }
>@@ -254,7 +255,7 @@ static MacroAssemblerCodeRef wasmToJs(VM* vm, Bag<CallLinkInfo>& callLinkInfos,
>     GPRReg importJSCellGPRReg = GPRInfo::regT0; // Callee needs to be in regT0 for slow path below.
>     ASSERT(!wasmCC.m_calleeSaveRegisters.get(importJSCellGPRReg));
> 
>-    materializeImportJSCell(vm, jit, importIndex, importJSCellGPRReg);
>+    materializeImportJSCell(jit, importIndex, importJSCellGPRReg);
> 
>     jit.store64(importJSCellGPRReg, calleeFrame.withOffset(CallFrameSlot::callee * static_cast<int>(sizeof(Register))));
>     jit.store32(JIT::TrustedImm32(numberOfParameters), calleeFrame.withOffset(CallFrameSlot::argumentCount * static_cast<int>(sizeof(Register)) + PayloadOffset));
>@@ -426,13 +427,13 @@ static MacroAssemblerCodeRef wasmToWasm(VM* vm, unsigned importIndex)
>     GPRReg scratch = GPRInfo::nonPreservedNonArgumentGPR;
> 
>     // B3's call codegen ensures that the JSCell is a WebAssemblyFunction.
>-    materializeImportJSCell(vm, jit, importIndex, scratch);
>+    materializeImportJSCell(jit, importIndex, scratch);
> 
>-    // Get the callee's WebAssembly.Instance and set it as vm.topJSWebAssemblyInstance. The caller will take care of restoring its own Instance.
>+    // Get the callee's WebAssembly.Instance and set it as WasmTop. The caller will take care of restoring its own Instance.
>     GPRReg baseMemory = pinnedRegs.baseMemoryPointer;
>     ASSERT(baseMemory != scratch);
>     jit.loadPtr(JIT::Address(scratch, WebAssemblyFunction::offsetOfInstance()), baseMemory); // Instance*.
>-    jit.storePtr(baseMemory, &vm->topJSWebAssemblyInstance);
>+    WasmTop::store(jit, baseMemory);
> 
>     // FIXME the following code assumes that all WebAssembly.Instance have the same pinned registers. https://bugs.webkit.org/show_bug.cgi?id=162952
>     // Set up the callee's baseMemory register as well as the memory size registers.
>diff --git a/Source/JavaScriptCore/wasm/WasmTop.cpp b/Source/JavaScriptCore/wasm/WasmTop.cpp
>new file mode 100644
>index 0000000..de6e5d4
>--- /dev/null
>+++ b/Source/JavaScriptCore/wasm/WasmTop.cpp
>@@ -0,0 +1,128 @@
>+/*
>+ * Copyright (C) 2017 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#include "config.h"
>+#include "WasmTop.h"
>+
>+#if ENABLE(WEBASSEMBLY)
>+
>+#include "AllowMacroScratchRegisterUsage.h"
>+#include "B3BasicBlockInlines.h"
>+#include "B3PatchPointValue.h"
>+#include "B3StackmapGenerationParams.h"
>+#include "CCallHelpers.h"
>+#include "MacroAssembler.h"
>+#include <mutex>
>+#include <wtf/FastTLS.h>
>+
>+namespace {
>+
>+template<typename T>
>+T getWebAssemblyTLSSlot()
>+{
>+    return bitwise_cast<T>(_pthread_getspecific_direct(WTF_WEBASSEMBLY_KEY));
>+}
>+
>+template<typename T>
>+void setWebAssemblyTLSSlot(T value)
>+{
>+    _pthread_setspecific_direct(WTF_WEBASSEMBLY_KEY, bitwise_cast<void*>(value));
>+}
>+
>+void initializeWasmTop()
>+{
>+    static std::once_flag once;
>+    std::call_once(once, [] {
>+        setWebAssemblyTLSSlot(nullptr);
>+    });
>+}
>+
>+} // anonymous namespace
>+
>+namespace JSC {
>+
>+using namespace B3;
>+
>+JSWebAssemblyInstance* WasmTop::load()
>+    {
>+    initializeWasmTop();
>+    return getWebAssemblyTLSSlot<JSWebAssemblyInstance*>();
>+}
>+
>+void WasmTop::store(JSWebAssemblyInstance* instance)
>+{
>+    initializeWasmTop();
>+    setWebAssemblyTLSSlot(instance);
>+}
>+
>+
>+void WasmTop::load(CCallHelpers& jit, GPRReg dst)
>+{
>+    initializeWasmTop();
>+#if ENABLE(FAST_TLS_JIT)
>+    jit.loadFromTLSPtr(fastTLSOffsetForKey(WTF_WEBASSEMBLY_KEY), dst);
>+#else
>+#error WebAssembly without fast TLS isn't implemented yet.
>+#endif
>+}
>+
>+void WasmTop::store(CCallHelpers& jit, GPRReg src)
>+{
>+    initializeWasmTop();
>+#if ENABLE(FAST_TLS_JIT)
>+    jit.storeToTLSPtr(src, fastTLSOffsetForKey(WTF_WEBASSEMBLY_KEY));
>+#else
>+#error WebAssembly without fast TLS isn't implemented yet.
>+#endif
>+}
>+
>+Value* WasmTop::load(Procedure& proc, BasicBlock* block)
>+{
>+    PatchpointValue* patchpoint = block->appendNew<PatchpointValue>(proc, pointerType(), Origin());
>+    patchpoint->clobber(RegisterSet::macroScratchRegisters());
>+    patchpoint->setGenerator(
>+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
>+            AllowMacroScratchRegisterUsage allowScratch(jit);
>+            WasmTop::load(jit, params[0].gpr());
>+        });
>+
>+    return block->appendNew<Value>(proc, Identity, Origin(), patchpoint);
>+}
>+
>+void WasmTop::store(Procedure& proc, BasicBlock* block, Value* arg)
>+{
>+    PatchpointValue* patchpoint = block->appendNew<PatchpointValue>(proc, Void, Origin());
>+    patchpoint->clobber(RegisterSet::macroScratchRegisters());
>+    patchpoint->append(ConstrainedValue(arg, ValueRep::SomeRegister));
>+    patchpoint->setGenerator(
>+        [&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
>+            AllowMacroScratchRegisterUsage allowScratch(jit);
>+            WasmTop::store(jit, params[0].gpr());
>+        });
>+}
>+
>+} // namespace JSC
>+
>+#endif // ENABLE(WEBASSEMBLY)
>diff --git a/Source/JavaScriptCore/wasm/WasmTop.h b/Source/JavaScriptCore/wasm/WasmTop.h
>new file mode 100644
>index 0000000..7c398a1
>--- /dev/null
>+++ b/Source/JavaScriptCore/wasm/WasmTop.h
>@@ -0,0 +1,60 @@
>+/*
>+ * Copyright (C) 2017 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#pragma once
>+
>+#if ENABLE(WEBASSEMBLY)
>+
>+#include "GPRInfo.h"
>+
>+namespace JSC {
>+
>+class CCallHelpers;
>+class JSWebAssemblyInstance;
>+
>+namespace B3 {
>+class Value;
>+class Procedure;
>+class BasicBlock;
>+}
>+
>+class WasmTop {
>+    WasmTop();
>+    WasmTop(const WasmTop&) = delete;
>+
>+public:
>+    static JSWebAssemblyInstance* load();
>+    static void store(JSWebAssemblyInstance*);
>+
>+    static void load(CCallHelpers&, GPRReg);
>+    static void store(CCallHelpers&, GPRReg);
>+
>+    static B3::Value* load(B3::Procedure&, B3::BasicBlock*);
>+    static void store(B3::Procedure&, B3::BasicBlock*, B3::Value*);
>+};
>+
>+} // namespace JSC
>+
>+#endif // ENABLE(WEBASSEMBLY)
>diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp b/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp
>index 04ed666..17335dc 100644
>--- a/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp
>+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp
>@@ -41,6 +41,7 @@
> #include "VM.h"
> #include "WasmFormat.h"
> #include "WasmMemory.h"
>+#include "WasmTop.h"
> 
> namespace JSC {
> 
>@@ -117,11 +118,12 @@ static EncodedJSValue JSC_HOST_CALL callWebAssemblyFunction(ExecState* exec)
>     protoCallFrame.init(nullptr, wasmFunction, firstArgument, argCount, remainingArgs);
> 
>     // FIXME Do away with this entire function, and only use the entrypoint generated by B3. https://bugs.webkit.org/show_bug.cgi?id=166486
>-    JSWebAssemblyInstance* prevJSWebAssemblyInstance = vm.topJSWebAssemblyInstance;
>-    vm.topJSWebAssemblyInstance = wasmFunction->instance();
>+    JSWebAssemblyInstance* prevJSWebAssemblyInstance = WasmTop::load();
>+    WasmTop::store(wasmFunction->instance());
>     ASSERT(wasmFunction->instance());
>+    ASSERT(wasmFunction->instance() == WasmTop::load());
>     EncodedJSValue rawResult = vmEntryToWasm(wasmFunction->jsEntrypoint(), &vm, &protoCallFrame);
>-    vm.topJSWebAssemblyInstance = prevJSWebAssemblyInstance;
>+    WasmTop::store(prevJSWebAssemblyInstance);
>     RETURN_IF_EXCEPTION(scope, { });
> 
>     switch (signature->returnType()) {
>diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.h b/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.h
>index 1b214ce..3a37540 100644
>--- a/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.h
>+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.h
>@@ -32,6 +32,7 @@
> 
> namespace JSC {
> 
>+class JSWebAssemblyInstance;
> class JSWebAssemblyModule;
> class WebAssemblyInstancePrototype;
> 
>diff --git a/Source/WTF/ChangeLog b/Source/WTF/ChangeLog
>index 147875d..bb4f254 100644
>--- a/Source/WTF/ChangeLog
>+++ b/Source/WTF/ChangeLog
>@@ -1,3 +1,14 @@
>+2017-03-15  JF Bastien  <jfbastien@apple.com>
>+
>+        WebAssembly: store state in TLS instead of on VM
>+        https://bugs.webkit.org/show_bug.cgi?id=169611
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * wtf/FastTLS.h: reserve one key for WebAssembly, delete a bunch
>+        of dead code which clang couldn't compile (it's valid GCC assembly
>+        which LLVM dislikes).
>+
> 2017-03-13  Chris Dumez  <cdumez@apple.com>
> 
>         [WK2] Only report background WebProcesses as unresponsive in the background after 90 seconds
>diff --git a/Source/WTF/wtf/FastTLS.h b/Source/WTF/wtf/FastTLS.h
>index 63f8839..32dbc1d 100644
>--- a/Source/WTF/wtf/FastTLS.h
>+++ b/Source/WTF/wtf/FastTLS.h
>@@ -29,6 +29,7 @@
> 
> #include <pthread.h>
> #include <System/pthread_machdep.h>
>+#include <wtf/Platform.h>
> 
> namespace WTF {
> 
>@@ -44,52 +45,20 @@ namespace WTF {
> // accidentally use the same key for more than one thing.
> 
> #define WTF_THREAD_DATA_KEY WTF_FAST_TLS_KEY0
>+#define WTF_WEBASSEMBLY_KEY WTF_FAST_TLS_KEY1
> #define WTF_TESTING_KEY WTF_FAST_TLS_KEY3
> 
> #if ENABLE(FAST_TLS_JIT)
>-// Below is the code that the JIT will emit.
>-
>-#if CPU(X86_64)
>-inline uintptr_t loadFastTLS(unsigned offset)
>-{
>-    uintptr_t result;
>-    asm volatile(
>-        "movq %%gs:%1, %0"
>-        : "=r"(result)
>-        : "r"(offset)
>-        : "memory");
>-    return result;
>-}
>-#elif CPU(ARM64)
>-inline uintptr_t loadFastTLS(unsigned passedOffset)
>-{
>-    uintptr_t result;
>-    uintptr_t offset = passedOffset;
>-    asm volatile(
>-        "mrs %0, TPIDRRO_EL0\n\t"
>-        "and %0, %0, #0xfffffffffffffff8\n\t"
>-        "ldr %0, [%0, %1]"
>-        : "=r"(result)
>-        : "r"(offset)
>-        : "memory");
>-    return result;
>-}
>-#else
>-#error "Bad architecture"
>-#endif
>-#endif // ENABLE(FAST_TLS_JIT)
>-
> inline unsigned fastTLSOffsetForKey(unsigned long slot)
> {
>     return slot * sizeof(void*);
> }
>+#endif
> 
> } // namespace WTF
> 
>-using WTF::fastTLSOffsetForKey;
>-
> #if ENABLE(FAST_TLS_JIT)
>-using WTF::loadFastTLS;
>+using WTF::fastTLSOffsetForKey;
> #endif
> 
> #endif // HAVE(FAST_TLS)
>-- 
>2.10.1
>

Actions: View | Formatted Diff | Diff

Attachments on bug 169611: 304587 | 304589 | 304590 | 304665 | 304795 | 304825 | 304931 | 305251 | 305293 | 305296 | 305326