Skip to content

Commit 8a9e1a5

Browse files
ConstellationConstellation
committed
[JSC] Remove CagedPtr's Data PAC tagging since it is not adding values
https://bugs.webkit.org/show_bug.cgi?id=267961 rdar://121473792 Reviewed by Mark Lam. This patch removes CagedPtr's Data PAC tagging since, 1. From attacking patterns, this does not add values. Right now, we continue using Gigacage, but not using Data PAC here. 2. We found that Data PAC is extremely slow. Attached benchmark showed 11.5% difference. ToT Patched segmentation 128.8931+-0.3854 ^ 115.6124+-0.1073 ^ definitely 1.1149x faster * Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp: (JSC::InlineCacheCompiler::generateWithGuard): * Source/JavaScriptCore/dfg/DFGOperations.cpp: (JSC::DFG::newTypedArrayWithSize): * Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::jumpForTypedArrayIsDetachedIfOutOfBounds): * Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h: * Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): * Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::emitNewTypedArrayWithSize): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * Source/JavaScriptCore/jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::cageWithoutUntagging): (JSC::AssemblyHelpers::cageConditionallyAndUntag): * Source/JavaScriptCore/jit/AssemblyHelpers.h: (JSC::AssemblyHelpers::toBigInt64): * Source/JavaScriptCore/llint/InPlaceInterpreter.asm: * Source/JavaScriptCore/llint/LowLevelInterpreter64.asm: * Source/JavaScriptCore/llint/WebAssembly.asm: * Source/JavaScriptCore/runtime/ArrayBuffer.h: * Source/JavaScriptCore/runtime/ArrayBufferView.h: * Source/JavaScriptCore/runtime/BufferMemoryHandle.h: * Source/JavaScriptCore/runtime/CagedBarrierPtr.h: * Source/JavaScriptCore/runtime/JSArrayBufferView.cpp: (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext): (JSC::JSArrayBufferView::JSArrayBufferView): * Source/JavaScriptCore/runtime/JSArrayBufferView.h: * Source/JavaScriptCore/runtime/JSBigInt.h: * Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::reloadMemoryRegistersFromInstance): (JSC::Wasm::B3IRGenerator::emitIndirectCall): * Source/JavaScriptCore/wasm/WasmBBQJIT.cpp: (JSC::Wasm::BBQJITImpl::BBQJIT::loadWebAssemblyGlobalState): * Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp: (JSC::Wasm::BBQJITImpl::BBQJIT::restoreWebAssemblyGlobalStateAfterWasmCall): * Source/JavaScriptCore/wasm/WasmBinding.cpp: (JSC::Wasm::wasmToWasm): * Source/JavaScriptCore/wasm/WasmInstance.h: (JSC::Wasm::Instance::updateCachedMemory): * Source/JavaScriptCore/wasm/js/JSToWasm.cpp: (JSC::Wasm::createJSToWasmWrapper): * Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp: (JSC::WebAssemblyFunction::jsCallEntrypointSlow): * Source/WTF/wtf/CagedPtr.h: (WTF::CagedPtr::CagedPtr): (WTF::CagedPtr::get const): (WTF::CagedPtr::getMayBeNull const): (WTF::CagedPtr::getUnsafe const): (WTF::CagedPtr::mergePointers): Deleted. * Source/WTF/wtf/CagedUniquePtr.h: Canonical link: https://commits.webkit.org/273389@main
1 parent 9a9aef3 commit 8a9e1a5

40 files changed

Lines changed: 235 additions & 323 deletions

‎JSTests/microbenchmarks/segmentation.js‎

Lines changed: 114 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Source/JavaScriptCore/API/MarkedJSValueRefArray.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ class MarkedJSValueRefArray final : public BasicRawSentinelNode<MarkedJSValueRef
5858
JSValueRef* data()
5959
{
6060
if (m_buffer)
61-
return m_buffer.get(m_size);
61+
return m_buffer.get();
6262
return m_inlineBuffer;
6363
}
6464

‎Source/JavaScriptCore/assembler/testmasm.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5901,7 +5901,7 @@ static void testCagePreservesPACFailureBit()
59015901
constexpr GPRReg storageGPR = GPRInfo::argumentGPR0;
59025902
constexpr GPRReg lengthGPR = GPRInfo::argumentGPR1;
59035903
constexpr GPRReg scratchGPR = GPRInfo::argumentGPR2;
5904-
jit.cageConditionallyAndUntag(Gigacage::Primitive, storageGPR, lengthGPR, scratchGPR);
5904+
jit.cageConditionally(Gigacage::Primitive, storageGPR, lengthGPR, scratchGPR);
59055905
jit.move(GPRInfo::argumentGPR0, GPRInfo::returnValueGPR);
59065906
emitFunctionEpilogue(jit);
59075907
jit.ret();
@@ -5921,7 +5921,7 @@ static void testCagePreservesPACFailureBit()
59215921

59225922
auto cageWithoutAuthentication = compile([] (CCallHelpers& jit) {
59235923
emitFunctionPrologue(jit);
5924-
jit.cageWithoutUntagging(Gigacage::Primitive, GPRInfo::argumentGPR0);
5924+
jit.cage(Gigacage::Primitive, GPRInfo::argumentGPR0);
59255925
jit.move(GPRInfo::argumentGPR0, GPRInfo::returnValueGPR);
59265926
emitFunctionEpilogue(jit);
59275927
jit.ret();

‎Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1499,7 +1499,7 @@ void InlineCacheCompiler::generateWithGuard(AccessCase& accessCase, CCallHelpers
14991499
jit.load32(CCallHelpers::Address(baseGPR, JSArrayBufferView::offsetOfLength()), scratchGPR);
15001500
#endif
15011501
jit.loadPtr(CCallHelpers::Address(baseGPR, JSArrayBufferView::offsetOfVector()), scratch2GPR);
1502-
jit.cageConditionallyAndUntag(Gigacage::Primitive, scratch2GPR, scratchGPR, scratchGPR, false);
1502+
jit.cageConditionally(Gigacage::Primitive, scratch2GPR, scratchGPR, scratchGPR);
15031503
jit.signExtend32ToPtr(propertyGPR, scratchGPR);
15041504
if (isInt(type)) {
15051505
switch (elementSize(type)) {
@@ -1987,7 +1987,7 @@ void InlineCacheCompiler::generateWithGuard(AccessCase& accessCase, CCallHelpers
19871987
jit.load32(CCallHelpers::Address(baseGPR, JSArrayBufferView::offsetOfLength()), scratchGPR);
19881988
#endif
19891989
jit.loadPtr(CCallHelpers::Address(baseGPR, JSArrayBufferView::offsetOfVector()), scratch2GPR);
1990-
jit.cageConditionallyAndUntag(Gigacage::Primitive, scratch2GPR, scratchGPR, scratchGPR, false);
1990+
jit.cageConditionally(Gigacage::Primitive, scratch2GPR, scratchGPR, scratchGPR);
19911991
jit.signExtend32ToPtr(propertyGPR, scratchGPR);
19921992
if (isInt(type)) {
19931993
if (isClamped(type)) {

‎Source/JavaScriptCore/dfg/DFGOperations.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ char* newTypedArrayWithSize(JSGlobalObject* globalObject, VM& vm, Structure* str
143143
size_t unsignedSize = static_cast<size_t>(size);
144144

145145
if (vector)
146-
return bitwise_cast<char*>(ViewClass::createWithFastVector(globalObject, structure, unsignedSize, untagArrayPtr(vector, unsignedSize)));
146+
return bitwise_cast<char*>(ViewClass::createWithFastVector(globalObject, structure, unsignedSize, vector));
147147

148148
RELEASE_AND_RETURN(scope, bitwise_cast<char*>(ViewClass::create(globalObject, structure, unsignedSize)));
149149
}

‎Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp‎

Lines changed: 8 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -3905,21 +3905,9 @@ JITCompiler::Jump SpeculativeJIT::jumpForTypedArrayIsDetachedIfOutOfBounds(Node*
39053905
Address(base, JSArrayBufferView::offsetOfMode()),
39063906
TrustedImm32(isWastefulTypedArrayMode));
39073907

3908-
Jump hasNullVector;
3909-
#if CPU(ARM64E)
3910-
{
3911-
GPRReg scratch = scratchRegister();
3912-
DisallowMacroScratchRegisterUsage disallowScratch(*this);
3913-
3914-
loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), scratch);
3915-
removeArrayPtrTag(scratch);
3916-
hasNullVector = branchTestPtr(Zero, scratch);
3917-
}
3918-
#else // CPU(ARM64E)
3919-
hasNullVector = branchTestPtr(
3908+
auto hasNullVector = branchTestPtr(
39203909
Zero,
39213910
Address(base, JSArrayBufferView::offsetOfVector()));
3922-
#endif
39233911
speculationCheck(Uncountable, JSValueSource(), node, hasNullVector);
39243912
notWasteful.link(this);
39253913
}
@@ -8760,38 +8748,23 @@ void SpeculativeJIT::compileConstantStoragePointer(Node* node)
87608748
storageResult(storageGPR, node);
87618749
}
87628750

8763-
void SpeculativeJIT::cageTypedArrayStorage(GPRReg baseReg, GPRReg storageReg, bool validateAuth)
8751+
void SpeculativeJIT::cageTypedArrayStorage(GPRReg baseReg, GPRReg storageReg)
87648752
{
8765-
auto untagArrayPtr = [&]() {
8766-
#if CPU(ARM64E)
8767-
untagArrayPtrLength64(Address(baseReg, JSArrayBufferView::offsetOfLength()), storageReg, validateAuth);
8768-
#else
8769-
UNUSED_PARAM(validateAuth);
8770-
UNUSED_PARAM(baseReg);
8771-
UNUSED_PARAM(storageReg);
8772-
#endif
8773-
};
8774-
8775-
#if GIGACAGE_ENABLED
87768753
UNUSED_PARAM(baseReg);
8777-
if (!Gigacage::shouldBeEnabled()) {
8778-
untagArrayPtr();
8754+
UNUSED_PARAM(storageReg);
8755+
#if GIGACAGE_ENABLED
8756+
if (!Gigacage::shouldBeEnabled())
87798757
return;
8780-
}
87818758

87828759
if (!Gigacage::disablingPrimitiveGigacageIsForbidden()) {
87838760
VM& vm = this->vm();
8784-
if (vm.primitiveGigacageEnabled().isStillValid())
8785-
m_graph.watchpoints().addLazily(vm.primitiveGigacageEnabled());
8786-
else {
8787-
untagArrayPtr();
8761+
if (!vm.primitiveGigacageEnabled().isStillValid())
87888762
return;
8789-
}
8763+
m_graph.watchpoints().addLazily(vm.primitiveGigacageEnabled());
87908764
}
87918765

8792-
cageWithoutUntagging(Gigacage::Primitive, storageReg);
8766+
cage(Gigacage::Primitive, storageReg);
87938767
#endif
8794-
untagArrayPtr();
87958768
}
87968769

87978770
void SpeculativeJIT::compileGetIndexedPropertyStorage(Node* node)
@@ -12179,11 +12152,6 @@ void SpeculativeJIT::emitNewTypedArrayWithSizeInRegister(Node* node, TypedArrayT
1217912152
BaseIndex(storageGPR, scratchGPR, TimesFour));
1218012153
branchTest32(NonZero, scratchGPR).linkTo(loop, this);
1218112154
done.link(this);
12182-
#if CPU(ARM64E)
12183-
// sizeGPR is still boxed as a number and there is no 32-bit variant of the PAC instructions.
12184-
zeroExtend48ToWord(sizeGPR, scratchGPR); // See rdar://107561209, rdar://107724053.
12185-
tagArrayPtr(scratchGPR, storageGPR);
12186-
#endif
1218712155

1218812156
auto butterfly = TrustedImmPtr(nullptr);
1218912157
switch (typedArrayType) {

‎Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1822,7 +1822,7 @@ class SpeculativeJIT : public JITCompiler {
18221822
template<bool strict>
18231823
GPRReg fillSpeculateInt32Internal(Edge, DataFormat& returnFormat);
18241824

1825-
void cageTypedArrayStorage(GPRReg, GPRReg, bool validateAuth = true);
1825+
void cageTypedArrayStorage(GPRReg, GPRReg);
18261826

18271827
void recordSetLocal(
18281828
Operand bytecodeReg, VirtualRegister machineReg, DataFormat format)

‎Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5874,7 +5874,7 @@ void SpeculativeJIT::compile(Node* node)
58745874
speculationCheck(OutOfBounds, JSValueRegs(), node, branch64(AboveOrEqual, t2, t1));
58755875

58765876
loadPtr(Address(dataViewGPR, JSArrayBufferView::offsetOfVector()), t2);
5877-
cageTypedArrayStorage(dataViewGPR, t2, false);
5877+
cageTypedArrayStorage(dataViewGPR, t2);
58785878

58795879
zeroExtend32ToWord(indexGPR, t1);
58805880
auto baseIndex = BaseIndex(t2, t1, TimesOne);
@@ -6091,7 +6091,7 @@ void SpeculativeJIT::compile(Node* node)
60916091
speculationCheck(OutOfBounds, JSValueRegs(), node, branch64(AboveOrEqual, t2, t1));
60926092

60936093
loadPtr(Address(dataViewGPR, JSArrayBufferView::offsetOfVector()), t2);
6094-
cageTypedArrayStorage(dataViewGPR, t2, false);
6094+
cageTypedArrayStorage(dataViewGPR, t2);
60956095

60966096
zeroExtend32ToWord(indexGPR, t1);
60976097
auto baseIndex = BaseIndex(t2, t1, TimesOne);

‎Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp‎

Lines changed: 5 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -9254,20 +9254,6 @@ IGNORE_CLANG_WARNINGS_END
92549254
m_out.int64Zero,
92559255
m_heaps.typedArrayProperties);
92569256

9257-
#if CPU(ARM64E)
9258-
{
9259-
PatchpointValue* authenticate = m_out.patchpoint(pointerType());
9260-
authenticate->appendSomeRegister(storage);
9261-
authenticate->append(size64Bits, B3::ValueRep(B3::ValueRep::SomeLateRegister));
9262-
authenticate->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
9263-
jit.move(params[1].gpr(), params[0].gpr());
9264-
jit.zeroExtend48ToWord(params[2].gpr(), params[2].gpr()); // See rdar://107561209, rdar://107724053.
9265-
jit.tagArrayPtr(params[2].gpr(), params[0].gpr());
9266-
});
9267-
storage = authenticate;
9268-
}
9269-
#endif
9270-
92719257
ValueFromBlock haveStorage = m_out.anchor(storage);
92729258

92739259
LValue fastResultValue = nullptr;
@@ -12532,7 +12518,7 @@ IGNORE_CLANG_WARNINGS_END
1253212518
else
1253312519
jit.loadPtr(CCallHelpers::Address(GPRInfo::wasmContextInstancePointer, Wasm::Instance::offsetOfCachedMemory()), GPRInfo::wasmBaseMemoryPointer);
1253412520
}
12535-
jit.cageConditionallyAndUntag(Gigacage::Primitive, GPRInfo::wasmBaseMemoryPointer, GPRInfo::wasmBoundsCheckingSizeRegister, scratchGPR, /* validateAuth */ true, /* mayBeNull */ false);
12521+
jit.cageConditionally(Gigacage::Primitive, GPRInfo::wasmBaseMemoryPointer, GPRInfo::wasmBoundsCheckingSizeRegister, scratchGPR);
1253612522
}
1253712523
}
1253812524

@@ -19431,66 +19417,17 @@ IGNORE_CLANG_WARNINGS_END
1943119417
}
1943219418
}
1943319419

19434-
LValue untagArrayPtr(LValue ptr, LValue size)
19435-
{
19436-
#if CPU(ARM64E)
19437-
PatchpointValue* authenticate = m_out.patchpoint(pointerType());
19438-
authenticate->appendSomeRegister(ptr);
19439-
authenticate->append(size, B3::ValueRep(B3::ValueRep::SomeLateRegister));
19440-
authenticate->numGPScratchRegisters = 1;
19441-
authenticate->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
19442-
jit.move(params[1].gpr(), params[0].gpr());
19443-
jit.untagArrayPtr(params[2].gpr(), params[0].gpr(), true, params.gpScratch(0));
19444-
});
19445-
return authenticate;
19446-
#else
19447-
UNUSED_PARAM(size);
19448-
return ptr;
19449-
#endif
19450-
}
19451-
19452-
LValue removeArrayPtrTag(LValue ptr)
19453-
{
19454-
#if CPU(ARM64E)
19455-
PatchpointValue* authenticate = m_out.patchpoint(pointerType());
19456-
authenticate->appendSomeRegister(ptr);
19457-
authenticate->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
19458-
jit.move(params[1].gpr(), params[0].gpr());
19459-
jit.removeArrayPtrTag(params[0].gpr());
19460-
});
19461-
return authenticate;
19462-
#endif
19463-
return ptr;
19464-
}
19465-
1946619420
LValue caged(Gigacage::Kind kind, LValue ptr, LValue base)
1946719421
{
19468-
auto doUntagArrayPtr = [&](LValue taggedPtr) {
19469-
#if CPU(ARM64E)
19470-
if (kind == Gigacage::Primitive) {
19471-
#if USE(LARGE_TYPED_ARRAYS)
19472-
LValue size = m_out.load64(base, m_heaps.JSArrayBufferView_length);
19473-
#else
19474-
LValue size = m_out.load32(base, m_heaps.JSArrayBufferView_length);
19475-
#endif
19476-
return untagArrayPtr(taggedPtr, size);
19477-
}
19478-
return ptr;
19479-
#else
19480-
UNUSED_PARAM(taggedPtr);
19481-
return ptr;
19482-
#endif
19483-
};
19484-
1948519422
#if GIGACAGE_ENABLED
1948619423
if (!Gigacage::isEnabled(kind))
19487-
return doUntagArrayPtr(ptr);
19424+
return ptr;
1948819425

1948919426
if (kind == Gigacage::Primitive && !Gigacage::disablingPrimitiveGigacageIsForbidden()) {
1949019427
if (vm().primitiveGigacageEnabled().isStillValid())
1949119428
m_graph.watchpoints().addLazily(vm().primitiveGigacageEnabled());
1949219429
else
19493-
return doUntagArrayPtr(ptr);
19430+
return ptr;
1949419431
}
1949519432

1949619433
LValue basePtr = m_out.constIntPtr(Gigacage::basePtr(kind));
@@ -19514,7 +19451,7 @@ IGNORE_CLANG_WARNINGS_END
1951419451
jit.insertBitField64(params[1].gpr(), CCallHelpers::TrustedImm32(0), CCallHelpers::TrustedImm32(64 - MacroAssembler::maxNumberOfAllowedPACBits), params[0].gpr());
1951519452
});
1951619453

19517-
result = doUntagArrayPtr(merge);
19454+
result = merge;
1951819455
}
1951919456
#endif // CPU(ARM64E)
1952019457

@@ -19534,7 +19471,7 @@ IGNORE_CLANG_WARNINGS_END
1953419471

1953519472
UNUSED_PARAM(kind);
1953619473
UNUSED_PARAM(base);
19537-
return doUntagArrayPtr(ptr);
19474+
return ptr;
1953819475
}
1953919476

1954019477
void buildSwitch(SwitchData* data, LType type, LValue switchValue)
@@ -22277,7 +22214,6 @@ IGNORE_CLANG_WARNINGS_END
2227722214
LValue vector = m_out.loadPtr(base, m_heaps.JSArrayBufferView_vector);
2227822215
// FIXME: We could probably make this a mask.
2227922216
// https://bugs.webkit.org/show_bug.cgi?id=197701
22280-
vector = removeArrayPtrTag(vector);
2228122217
speculate(Uncountable, jsValueValue(vector), m_node, m_out.isZero64(vector));
2228222218
m_out.jump(continuation);
2228322219

‎Source/JavaScriptCore/jit/AssemblyHelpers.cpp‎

Lines changed: 3 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -1424,91 +1424,43 @@ void AssemblyHelpers::copyCalleeSavesToEntryFrameCalleeSavesBufferImpl(GPRReg ca
14241424
#endif
14251425
}
14261426

1427-
void AssemblyHelpers::cageWithoutUntagging(Gigacage::Kind kind, GPRReg storage, bool mayBeNull)
1427+
void AssemblyHelpers::cage(Gigacage::Kind kind, GPRReg storage)
14281428
{
14291429
#if GIGACAGE_ENABLED
14301430
if (!Gigacage::isEnabled(kind))
14311431
return;
1432-
1433-
#if CPU(ARM64E)
1434-
RegisterID tempReg = InvalidGPRReg;
1435-
Jump skip;
1436-
if (kind == Gigacage::Primitive) {
1437-
if (mayBeNull)
1438-
skip = branchPtr(Equal, storage, TrustedImmPtr(JSArrayBufferView::nullVectorPtr()));
1439-
tempReg = getCachedMemoryTempRegisterIDAndInvalidate();
1440-
and64(TrustedImm64(Gigacage::mask(kind)), storage, tempReg);
1441-
addPtr(TrustedImmPtr(Gigacage::basePtr(kind)), tempReg);
1442-
// Flip the registers since bitFieldInsert only inserts into the low bits.
1443-
std::swap(storage, tempReg);
1444-
} else {
1445-
and64(TrustedImm64(Gigacage::mask(kind)), storage);
1446-
addPtr(TrustedImmPtr(Gigacage::basePtr(kind)), storage);
1447-
}
1448-
if (kind == Gigacage::Primitive)
1449-
insertBitField64(storage, TrustedImm32(0), TrustedImm32(64 - maxNumberOfAllowedPACBits), tempReg);
1450-
if (skip.isSet())
1451-
skip.link(this);
1452-
#else
1453-
UNUSED_PARAM(mayBeNull);
14541432
andPtr(TrustedImmPtr(Gigacage::mask(kind)), storage);
14551433
addPtr(TrustedImmPtr(Gigacage::basePtr(kind)), storage);
1456-
#endif
1457-
14581434
#else
14591435
UNUSED_PARAM(kind);
14601436
UNUSED_PARAM(storage);
1461-
UNUSED_PARAM(mayBeNull);
14621437
#endif
14631438
}
14641439

14651440
// length may be the same register as scratch.
1466-
void AssemblyHelpers::cageConditionallyAndUntag(Gigacage::Kind kind, GPRReg storage, GPRReg length, GPRReg scratch, bool validateAuth, bool mayBeNull)
1441+
void AssemblyHelpers::cageConditionally(Gigacage::Kind kind, GPRReg storage, GPRReg length, GPRReg scratch)
14671442
{
14681443
#if GIGACAGE_ENABLED
14691444
if (Gigacage::isEnabled(kind)) {
14701445
if (kind != Gigacage::Primitive || Gigacage::disablingPrimitiveGigacageIsForbidden())
1471-
cageWithoutUntagging(kind, storage, mayBeNull);
1446+
cage(kind, storage);
14721447
else {
1473-
#if CPU(ARM64E)
1474-
if (length == scratch)
1475-
scratch = getCachedMemoryTempRegisterIDAndInvalidate();
1476-
#endif
14771448
JumpList done;
1478-
#if CPU(ARM64E)
1479-
if (mayBeNull)
1480-
done.append(branchPtr(Equal, storage, TrustedImmPtr(JSArrayBufferView::nullVectorPtr())));
1481-
#endif
14821449
done.append(branchTest8(NonZero, AbsoluteAddress(&Gigacage::disablePrimitiveGigacageRequested)));
14831450

14841451
loadPtr(Gigacage::addressOfBasePtr(kind), scratch);
14851452
done.append(branchTest64(Zero, scratch));
1486-
#if CPU(ARM64E)
1487-
GPRReg tempReg = getCachedDataTempRegisterIDAndInvalidate();
1488-
move(storage, tempReg);
1489-
ASSERT(LogicalImmediate::create64(Gigacage::mask(kind)).isValid());
1490-
andPtr(TrustedImmPtr(Gigacage::mask(kind)), tempReg);
1491-
addPtr(scratch, tempReg);
1492-
insertBitField64(tempReg, TrustedImm32(0), TrustedImm32(64 - maxNumberOfAllowedPACBits), storage);
1493-
#else
14941453
andPtr(TrustedImmPtr(Gigacage::mask(kind)), storage);
14951454
addPtr(scratch, storage);
1496-
#endif // CPU(ARM64E)
14971455
done.link(this);
14981456
}
14991457
}
15001458
#endif
15011459

1502-
#if CPU(ARM64E)
1503-
if (kind == Gigacage::Primitive)
1504-
untagArrayPtr(length, storage, validateAuth, scratch);
1505-
#endif
1506-
UNUSED_PARAM(validateAuth);
15071460
UNUSED_PARAM(kind);
15081461
UNUSED_PARAM(storage);
15091462
UNUSED_PARAM(length);
15101463
UNUSED_PARAM(scratch);
1511-
UNUSED_PARAM(mayBeNull);
15121464
}
15131465

15141466
void AssemblyHelpers::emitSave(const RegisterAtOffsetList& list)

0 commit comments

Comments
 (0)