Bug 1630607: arm64: check that upper high bits are zero'd when boxing a 32-bit value; r=jandem
☠☠ backed out by aaa6e4426012 ☠ ☠
authorBenjamin Bouvier <benj@benj.me>
Fri, 17 Apr 2020 06:05:38 +0000
changeset 524555 60f939d5d3bc56097df7ee60bd58703b75969e53
parent 524554 bf118a2f538a7e0c203cb63710edc6f6a77617f1
child 524556 7488b281a91503d8d082a5835ee7be48cba472a3
push id37323
push userdluca@mozilla.com
push dateFri, 17 Apr 2020 16:25:55 +0000
treeherdermozilla-central@b4b1d6f91ef0 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1630607
milestone77.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1630607: arm64: check that upper high bits are zero'd when boxing a 32-bit value; r=jandem Differential Revision: https://phabricator.services.mozilla.com/D71175
js/src/jit/arm64/MacroAssembler-arm64.cpp
js/src/jit/arm64/MacroAssembler-arm64.h
--- a/js/src/jit/arm64/MacroAssembler-arm64.cpp
+++ b/js/src/jit/arm64/MacroAssembler-arm64.cpp
@@ -14,16 +14,31 @@
 #include "util/Memory.h"
 #include "vm/JitActivation.h"  // js::jit::JitActivation
 
 #include "jit/MacroAssembler-inl.h"
 
 namespace js {
 namespace jit {
 
+void MacroAssemblerCompat::boxValue(JSValueType type, Register src,
+                                    Register dest) {
+#ifdef DEBUG
+  if (type == JSVAL_TYPE_INT32 || type == JSVAL_TYPE_BOOLEAN) {
+    Label upper32BitsZeroed;
+    movePtr(ImmWord(UINT32_MAX), dest);
+    asMasm().branchPtr(Assembler::BelowOrEqual, src, dest, &upper32BitsZeroed);
+    breakpoint();
+    bind(&upper32BitsZeroed);
+  }
+#endif
+  Orr(ARMRegister(dest, 64), ARMRegister(src, 64),
+      Operand(ImmShiftedTag(type).value));
+}
+
 void MacroAssembler::clampDoubleToUint8(FloatRegister input, Register output) {
   ARMRegister dest(output, 32);
   Fcvtns(dest, ARMFPRegister(input, 64));
 
   {
     vixl::UseScratchRegisterScope temps(this);
     const ARMRegister scratch32 = temps.AcquireW();
 
--- a/js/src/jit/arm64/MacroAssembler-arm64.h
+++ b/js/src/jit/arm64/MacroAssembler-arm64.h
@@ -388,20 +388,18 @@ class MacroAssemblerCompat : public vixl
     BufferOffset off = immPool64(ARMRegister(dest, 64), imm.value);
     return CodeOffset(off.getOffset());
   }
   CodeOffset movWithPatch(ImmPtr imm, Register dest) {
     BufferOffset off = immPool64(ARMRegister(dest, 64), uint64_t(imm.value));
     return CodeOffset(off.getOffset());
   }
 
-  void boxValue(JSValueType type, Register src, Register dest) {
-    Orr(ARMRegister(dest, 64), ARMRegister(src, 64),
-        Operand(ImmShiftedTag(type).value));
-  }
+  void boxValue(JSValueType type, Register src, Register dest);
+
   void splitSignExtTag(Register src, Register dest) {
     sbfx(ARMRegister(dest, 64), ARMRegister(src, 64), JSVAL_TAG_SHIFT,
          (64 - JSVAL_TAG_SHIFT));
   }
   MOZ_MUST_USE Register extractTag(const Address& address, Register scratch) {
     loadPtr(address, scratch);
     splitSignExtTag(scratch, scratch);
     return scratch;