ChangeLog

2017-08-12  Filip Pizlo  <fpizlo@apple.com>

        FTL's compileGetTypedArrayByteOffset needs to do caging

        https://bugs.webkit.org/show_bug.cgi?id=175366

        Reviewed by NOBODY (OOPS!).

        While implementing boxing in the DFG, I noticed that there was some missing boxing in the FTL. This

        fixes the case in GetTypedArrayByteOffset, and files FIXMEs for more such cases.

        * dfg/DFGSpeculativeJIT.cpp:

        (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):

        * ftl/FTLLowerDFGToB3.cpp:

        (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):

        (JSC::FTL::DFG::LowerDFGToB3::cagedMayBeNull):

        * runtime/ArrayBuffer.h:

        * runtime/ArrayBufferView.h:

        * runtime/JSArrayBufferView.h:

2017-08-11  Filip Pizlo  <fpizlo@apple.com>

        Caging shouldn't have to use a patchpoint for adding

220625

Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@void SpeculativeJIT::compileGetTypedArra

    cageTypedArrayStorage(vectorGPR);

    nullVector.link(&m_jit);

    m_jit.loadPtr(MacroAssembler::Address(dataGPR, Butterfly::offsetOfArrayBuffer()), dataGPR);

6201 // FIXME: This needs caging.

6202 // https://bugs.webkit.org/show_bug.cgi?id=175515

    m_jit.loadPtr(MacroAssembler::Address(dataGPR, ArrayBuffer::offsetOfData()), dataGPR);

    m_jit.subPtr(dataGPR, vectorGPR);

220625

Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@private:

        m_out.appendTo(wastefulCase, continuation);

        // FIXME: This needs to do caging.

        // https://bugs.webkit.org/show_bug.cgi?id=175366

        LValue vectorPtr = m_out.loadPtr(basePtr, m_heaps.JSArrayBufferView_vector);

        LValue butterflyPtr = m_out.loadPtr(basePtr, m_heaps.JSObject_butterfly);

        LValue vectorPtr = cagedMayBeNull(

            Gigacage::Primitive,

            m_out.loadPtr(basePtr, m_heaps.JSArrayBufferView_vector));

        LValue butterflyPtr = caged(Gigacage::JSValue, m_out.loadPtr(basePtr, m_heaps.JSObject_butterfly));

33163316 LValue arrayBufferPtr = m_out.loadPtr(butterflyPtr, m_heaps.Butterfly_arrayBuffer);

3317 // FIXME: This needs caging.

3318 // https://bugs.webkit.org/show_bug.cgi?id=175515

        LValue dataPtr = m_out.loadPtr(arrayBufferPtr, m_heaps.ArrayBuffer_data);

        ValueFromBlock wastefulOut = m_out.anchor(m_out.sub(vectorPtr, dataPtr));

@@private:

        return m_out.opaque(result);

    }

    LValue cagedMayBeNull(Gigacage::Kind kind, LValue ptr)

    {

        LBasicBlock notNull = m_out.newBlock();

        LBasicBlock continuation = m_out.newBlock();

        LBasicBlock lastNext = m_out.insertNewBlocksBefore(notNull);

        ValueFromBlock nullResult = m_out.anchor(ptr);

        m_out.branch(ptr, unsure(notNull), unsure(continuation));

        m_out.appendTo(notNull, continuation);

        ValueFromBlock notNullResult = m_out.anchor(caged(kind, ptr));

        m_out.jump(continuation);

        m_out.appendTo(continuation, lastNext);

        return m_out.phi(pointerType(), nullResult, notNullResult);

    }

    void buildSwitch(SwitchData* data, LType type, LValue switchValue)

    {

        ASSERT(type == pointerType() || type == Int32);

220625

Source/JavaScriptCore/runtime/ArrayBuffer.h

@@public:

    void* data() const { return m_data; }

private:

53 // FIXME: This should be CagedPtr<>.

54 // https://bugs.webkit.org/show_bug.cgi?id=175515

    void* m_data;

    ArrayBufferDestructorFunction m_destructor;

};

@@private:

    ArrayBufferDestructorFunction m_destructor;

    RefPtr<SharedArrayBufferContents> m_shared;

100 // FIXME: This should be CagedPtr<>.

101 // https://bugs.webkit.org/show_bug.cgi?id=175515

    void* m_data;

    unsigned m_sizeInBytes;

};

220625

Source/JavaScriptCore/runtime/ArrayBufferView.h

@@protected:

    }

    // This is the address of the ArrayBuffer's storage, plus the byte offset.

150 // FIXME: This should be CagedPtr<>.

151 // https://bugs.webkit.org/show_bug.cgi?id=175515

    void* m_baseAddress;

    unsigned m_byteOffset : 31;

220625

Source/JavaScriptCore/runtime/JSArrayBufferView.h

@@protected:

        
    private:

        Structure* m_structure;

143 // FIXME: This should be CagedPtr<>.

144 // https://bugs.webkit.org/show_bug.cgi?id=175515

        void* m_vector;

        uint32_t m_length;

        TypedArrayMode m_mode;

@@protected:

    static String toStringName(const JSObject*, ExecState*);

195 // FIXME: This should be CagedBarrierPtr<>.

196 // https://bugs.webkit.org/show_bug.cgi?id=175515

    AuxiliaryBarrier<void*> m_vector;

    uint32_t m_length;

    TypedArrayMode m_mode;

220625