ChangeLog

2021-08-10  Saam Barati  <sbarati@apple.com>

        Update ARM64EHash

        https://bugs.webkit.org/show_bug.cgi?id=228962

        <rdar://79883337>

        Reviewed by NOBODY (OOPS!).

        * assembler/AssemblerBuffer.h:

        (JSC::ARM64EHash::makeDiversifier):

        (JSC::ARM64EHash::nextValue):

        (JSC::ARM64EHash::bitsForDiversifier):

        (JSC::ARM64EHash::currentHash):

        (JSC::ARM64EHash::setUpdatedHash):

        (JSC::ARM64EHash::ARM64EHash):

        (JSC::ARM64EHash::update):

        (JSC::ARM64EHash::finalize):

        (JSC::AssemblerBuffer::AssemblerBuffer):

        (JSC::AssemblerBuffer::putIntegralUnchecked):

        (JSC::AssemblerBuffer::hash const):

        * assembler/LinkBuffer.cpp:

        (JSC::LinkBuffer::copyCompactAndLinkCode):

2021-08-10  Keith Miller  <keith_miller@apple.com>

        CallFrame::returnPC should untag the return address before passing it to ReturnAddressPtr

280858

Source/JavaScriptCore/assembler/AssemblerBuffer.h

@@namespace JSC {

#if CPU(ARM64E)

    class ARM64EHash {

    public:

208 ARM64EHash(uint32_t initialHash)

209 : m_hash(initialHash)

        static constexpr uint8_t initializationNamespace = 0x11;

        static ALWAYS_INLINE PtrTag makeDiversifier(uint8_t namespaceTag, uint64_t index, uint32_t value)

        {

            // <namespaceTag:8><index:24><value:32>

            return static_cast<PtrTag>((static_cast<uint64_t>(namespaceTag) << 56) + ((index & 0xFFFFFF) << 32) + static_cast<uint64_t>(value));

        }

        static ALWAYS_INLINE uint32_t nextValue(uint64_t instruction, uint64_t index, uint32_t currentValue)

210217 {

            uint64_t a = tagInt(instruction, makeDiversifier(0x12, index, currentValue));

            uint64_t b = tagInt(instruction, makeDiversifier(0x13, index, currentValue));

            return static_cast<uint32_t>((a >> 39) ^ (b >> 23));

211221 }

212222

213 ALWAYS_INLINE uint32_t update(uint32_t value)

        static ALWAYS_INLINE uint32_t bitsForDiversifier(void* diversifier)

        {

            return static_cast<uint32_t>(bitwise_cast<uintptr_t>(diversifier));

        }

        ALWAYS_INLINE uint32_t currentHash(uint32_t index, void* diversifier)

        {

            uint64_t result;

            bool hashFieldIsTagged = index == 0;

            if (hashFieldIsTagged)

                result = untagInt(m_hash, makeDiversifier(initializationNamespace, index, bitsForDiversifier(diversifier)));

            else

                result = m_hash;

            return static_cast<uint32_t>(result);

        }

        ALWAYS_INLINE void setUpdatedHash(uint32_t value, uint32_t index, void* diversifier)

        {

            bool shouldTagHashField = index == 0;

            if (shouldTagHashField)

                m_hash = tagInt(static_cast<uint64_t>(value), makeDiversifier(initializationNamespace, index, bitsForDiversifier(diversifier)));

            else

                m_hash = value;

        }

        ARM64EHash(void* diversifier)

        {

            setUpdatedHash(0, 0, diversifier);

        }

        ALWAYS_INLINE uint32_t update(uint32_t instruction, uint32_t index, void* diversifier)

214254 {

            uint64_t input = value ^ m_hash;

            uint64_t a = static_cast<uint32_t>(tagInt(input, static_cast<PtrTag>(0)) >> 39);

            uint64_t b = tagInt(input, static_cast<PtrTag>(0xb7e151628aed2a6a)) >> 23;

            m_hash = a ^ b;

            return m_hash;

            uint32_t currentHash = this->currentHash(index, diversifier);

            uint64_t nextIndex = index + 1;

            uint32_t output = nextValue(instruction, nextIndex, currentHash);

            setUpdatedHash(output, nextIndex, diversifier);

            return output;

        }

    private:

223 uint32_t m_hash;

263 uint64_t m_hash;

    };

#endif

@@namespace JSC {

            : m_storage()

            , m_index(0)

#if CPU(ARM64E)

233 , m_hash(~~static_cast<uint32_t>(bitwise_cast<uint64_t>(~~this)))

273 , m_hash(this)

            , m_hashes()

#endif

        {

@@namespace JSC {

#if CPU(ARM64)

            static_assert(sizeof(value) == 4, "");

#if CPU(ARM64E)

391 uint32_t hash = m_hash.update(value);

431 uint32_t hash = m_hash.update(value, m_index / sizeof(IntegralType), this);

            WTF::unalignedStore<uint32_t>(m_hashes.buffer() + m_index, hash);

#endif

#endif

280703

Source/JavaScriptCore/assembler/LinkBuffer.cpp

@@void LinkBuffer::copyCompactAndLinkCode(

    m_assemblerStorage = macroAssembler.m_assembler.buffer().releaseAssemblerData();

    uint8_t* inData = bitwise_cast<uint8_t*>(m_assemblerStorage.buffer());

#if CPU(ARM64E)

248 ARM64EHash verifyUncompactedHash { static_cast<uint32_t>(bitwise_cast<uint64_t>(&macroAssembler.m_assembler.buffer())) };

248 void* bufferPtr = &macroAssembler.m_assembler.buffer();

249 ARM64EHash verifyUncompactedHash { bufferPtr };

    m_assemblerHashesStorage = macroAssembler.m_assembler.buffer().releaseAssemblerHashes();

    uint32_t* inHashes = bitwise_cast<uint32_t*>(m_assemblerHashesStorage.buffer());

#endif

@@void LinkBuffer::copyCompactAndLinkCode(

    auto read = [&](const InstructionType* ptr) -> InstructionType {

        InstructionType value = *ptr;

#if CPU(ARM64E)

270 uint32_t hash = verifyUncompactedHash.update(value);

271271 unsigned index = (bitwise_cast<uint8_t*>(ptr) - inData) / 4;

272 uint32_t hash = verifyUncompactedHash.update(value, index, bufferPtr);

        RELEASE_ASSERT(inHashes[index] == hash);

#endif

        return value;

280703