Commit 17acca13 authored by Jan de Mooij's avatar Jan de Mooij
Browse files

Bug 1692972 - Add DoubleValue masking for LBox/LBoxFloatingPoint. r=iain, a=RyanVM 

Differential Revision: https://phabricator.services.mozilla.com/D107042
parent 99c0758a

js/src/jit/MacroAssembler.h

+4 −0
Original line number Diff line number Diff line
@@ -1734,6 +1734,10 @@ class MacroAssembler : public MacroAssemblerSpecific { 
                          Register src, Register dest)

      DEFINED_ON(arm, arm64, mips_shared, x86_shared);



  inline void cmpPtrMovePtr(Condition cond, Register lhs, Register rhs,

                            Register src, Register dest)

      DEFINED_ON(x64);



  inline void cmp32Load32(Condition cond, Register lhs, const Address& rhs,

                          const Address& src, Register dest)

      DEFINED_ON(arm, arm64, mips_shared, x86_shared);

js/src/jit/x64/Assembler-x64.h

+4 −0
Original line number Diff line number Diff line
@@ -496,6 +496,10 @@ class Assembler : public AssemblerX86Shared { 
        MOZ_CRASH("unexpected operand kind");

    }

  }

  void cmovCCq(Condition cond, Register src, Register dest) {

    X86Encoding::Condition cc = static_cast<X86Encoding::Condition>(cond);

    masm.cmovCCq_rr(cc, src.encoding(), dest.encoding());

  }

  void cmovzq(const Operand& src, Register dest) {

    cmovCCq(Condition::Zero, src, dest);

  }

js/src/jit/x64/CodeGenerator-x64.cpp

+7 −0
Original line number Diff line number Diff line
@@ -61,6 +61,13 @@ void CodeGenerator::visitBox(LBox* box) { 
  ValueOperand result = ToOutValue(box);



  masm.moveValue(TypedOrValueRegister(box->type(), ToAnyRegister(in)), result);



  if (JitOptions.spectreValueMasking && IsFloatingPointType(box->type())) {

    ScratchRegisterScope scratch(masm);

    masm.movePtr(ImmWord(JSVAL_SHIFTED_TAG_MAX_DOUBLE), scratch);

    masm.cmpPtrMovePtr(Assembler::Below, scratch, result.valueReg(), scratch,

                       result.valueReg());

  }

}



void CodeGenerator::visitUnbox(LUnbox* unbox) {

js/src/jit/x64/MacroAssembler-x64-inl.h

+6 −0
Original line number Diff line number Diff line
@@ -674,6 +674,12 @@ void MacroAssembler::branchToComputedAddress(const BaseIndex& address) { 
  jmp(Operand(address));

}



void MacroAssembler::cmpPtrMovePtr(Condition cond, Register lhs, Register rhs,

                                   Register src, Register dest) {

  cmpPtr(lhs, rhs);

  cmovCCq(cond, src, dest);

}



void MacroAssembler::cmp32MovePtr(Condition cond, Register lhs, Imm32 rhs,

                                  Register src, Register dest) {

  cmp32(lhs, rhs);

js/src/jit/x86/CodeGenerator-x86.cpp

+7 −0
Original line number Diff line number Diff line
@@ -91,6 +91,13 @@ void CodeGenerator::visitBoxFloatingPoint(LBoxFloatingPoint* box) { 
  const ValueOperand out = ToOutValue(box);



  masm.moveValue(TypedOrValueRegister(box->type(), in), out);



  if (JitOptions.spectreValueMasking) {

    Register scratch = ToRegister(box->spectreTemp());

    masm.move32(Imm32(JSVAL_TAG_CLEAR), scratch);

    masm.cmp32Move32(Assembler::Below, scratch, out.typeReg(), scratch,

                     out.typeReg());

  }

}



void CodeGenerator::visitUnbox(LUnbox* unbox) {