Commit f45b69dc authored by Jan de Mooij's avatar Jan de Mooij
Browse files

Bug 1692972 - Add DoubleValue masking for LBox/LBoxFloatingPoint. r=iain, a=RyanVM 

Differential Revision: https://phabricator.services.mozilla.com/D107042
parent 1304aeb8

js/src/jit/x64/CodeGenerator-x64.cpp

+7 −0
Original line number Diff line number Diff line
@@ -61,6 +61,13 @@ void CodeGenerator::visitBox(LBox* box) { 
  ValueOperand result = ToOutValue(box);



  masm.moveValue(TypedOrValueRegister(box->type(), ToAnyRegister(in)), result);



  if (JitOptions.spectreValueMasking && IsFloatingPointType(box->type())) {

    ScratchRegisterScope scratch(masm);

    masm.movePtr(ImmWord(JSVAL_SHIFTED_TAG_MAX_DOUBLE), scratch);

    masm.cmpPtrMovePtr(Assembler::Below, scratch, result.valueReg(), scratch,

                       result.valueReg());

  }

}



void CodeGenerator::visitUnbox(LUnbox* unbox) {

js/src/jit/x86/CodeGenerator-x86.cpp

+7 −0
Original line number Diff line number Diff line
@@ -91,6 +91,13 @@ void CodeGenerator::visitBoxFloatingPoint(LBoxFloatingPoint* box) { 
  const ValueOperand out = ToOutValue(box);



  masm.moveValue(TypedOrValueRegister(box->type(), in), out);



  if (JitOptions.spectreValueMasking) {

    Register scratch = ToRegister(box->spectreTemp());

    masm.move32(Imm32(JSVAL_TAG_CLEAR), scratch);

    masm.cmp32Move32(Assembler::Below, scratch, out.typeReg(), scratch,

                     out.typeReg());

  }

}



void CodeGenerator::visitUnbox(LUnbox* unbox) {

js/src/jit/x86/LIR-x86.h

+5 −2
Original line number Diff line number Diff line
@@ -10,20 +10,23 @@ 
namespace js {

namespace jit {



class LBoxFloatingPoint : public LInstructionHelper<2, 1, 1> {

class LBoxFloatingPoint : public LInstructionHelper<2, 1, 2> {

  MIRType type_;



 public:

  LIR_HEADER(BoxFloatingPoint);



  LBoxFloatingPoint(const LAllocation& in, const LDefinition& temp,

                    MIRType type)

                    const LDefinition& spectreTemp, MIRType type)

      : LInstructionHelper(classOpcode), type_(type) {

    MOZ_ASSERT(IsFloatingPointType(type));

    setOperand(0, in);

    setTemp(0, temp);

    setTemp(1, spectreTemp);

  }



  const LDefinition* spectreTemp() { return getTemp(1); }



  MIRType type() const { return type_; }

  const char* extraName() const { return StringFromMIRType(type_); }

};

js/src/jit/x86/Lowering-x86.cpp

+5 −2
Original line number Diff line number Diff line
@@ -45,8 +45,11 @@ void LIRGenerator::visitBox(MBox* box) { 


  // If the box wrapped a double, it needs a new register.

  if (IsFloatingPointType(inner->type())) {

    defineBox(new (alloc()) LBoxFloatingPoint(

                  useRegisterAtStart(inner), tempCopy(inner, 0), inner->type()),

    LDefinition spectreTemp =

        JitOptions.spectreValueMasking ? temp() : LDefinition::BogusTemp();

    defineBox(new (alloc()) LBoxFloatingPoint(useRegisterAtStart(inner),

                                              tempCopy(inner, 0), spectreTemp,

                                              inner->type()),

              box);

    return;

  }