There is an erratum (835769) in some Cortex-A53, which can only be worked around at code generation: It is possible for an A64 64-bit multiply-accumulate instruction to generate an incorrect result when immediately preceded by a memory instruction. In WebKit, that means 4 affected stages, potentially:
1. compilation with gcc or clang
2. processing LLInt asm sources with the offline assembler
4. LLVM in FTL
1. Fixes for both gcc and clang have already been submitted:
So, if building WebKit for Cortex-A53, the build system should detect whether the compiler tool chain has support for the workaround and apply it if available.
2 & 3. Offlineasm & MacroAssembler should be amended with the workaround.
4. LLVM trunk already has the workaround, so as soon as ARM64 (for Linux) has FTL working, WebKit can rely on LLVM generating correct code.
Please make sure that whatever this fix is, it is possible to disable it. It should be disabled by default on Darwin.
Created attachment 240860 [details]
Built with Tools/Scripts/build-jsc --gtk --cmakeargs="-DWTF_CPU_ARM64_CORTEXA53=ON", no regression.
Some extra comments:
1) The ARM64 assembler runs into the nop generating code path in 162 jsc tests. E.g., in sunspider-1.0/string-fasta.js.default it generates something like this below:
57:< 1:-4> GetLocal(@1, JS, Int32, arg1(B<Int32>/FlushedInt32), machine:arg1, R:Variables(7), bc#98) predicting Int32
0x7fa947f30c: ldur w0, [fp, #56]
58:< 2:-4> ArithMul(Int32:@45, Int32:@57, Number, Int32, CheckOverflowAndNegativeZero, bc#98)
0x7fa947f314: smaddl x1, w2, w0, x31
2) For now, offlineasm generates no extra nops, since the LLInt asm sources contain no patterns which would trigger the nop-inserting code. The offlineasm part of the patch has been tested with crafted code (of no real use), however, and the generated assembly was OK. E.g.:
Comment on attachment 240860 [details]
View in context: https://bugs.webkit.org/attachment.cgi?id=240860&action=review
LGTM with the one suggestion.
> +#if CPU(ARM64_CORTEXA53)
You could remove this #if and instead have an #if inside the nopCortexA53Fix835769() method. That would beautify the code quite a bit without any change in perf or behavior.
Created attachment 240866 [details]
Thanks for the suggestion. Applied.
Comment on attachment 240866 [details]
Clearing flags on attachment: 240866
Committed r175514: <http://trac.webkit.org/changeset/175514>
All reviewed patches have been landed. Closing bug.