Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Signed loads should not zero-def their destination. #26593

Conversation

justinmichaud
Copy link
Contributor

@justinmichaud justinmichaud commented Mar 29, 2024

5838997

Signed loads should not zero-def their destination.
https://bugs.webkit.org/show_bug.cgi?id=271866
rdar://122959696

Reviewed by Yusuke Suzuki.

This fixes a hang in Google Meet when applying the Black Noir filter.

Suppose we have:

```
@a = Load8SignedExtendTo32(@x)

@b = Trunc(ZExt32(@a))
```

B3 reduceStrength will convert @b to @a. The Air register allocator will
see that we ZDef 64 bits in @a, but on ARM64, we actually sign-extend them.

This was caught by changing reduceStrength:

```
case Trunc:
    // Turn this: Trunc(SExt32(value)) or Trunc(ZExt32(value))
    // Into this: value
    if (m_value->child(0)->opcode() == SExt32 || m_value->child(0)->opcode() == ZExt32) {
        auto* value = m_value->child(0)->child(0);
        auto* patchpoint = m_insertionSet.insert<PatchpointValue>(
            m_index, m_value->type(), m_value->origin());

        patchpoint->effects = Effects();
        patchpoint->effects.reads = HeapRange::top();
        patchpoint->effects.exitsSideways = true;

        patchpoint->append(value);
        patchpoint->setGenerator([&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
            RELEASE_ASSERT(params.size() == 2);
            RELEASE_ASSERT(params[0].isGPR());
            RELEASE_ASSERT(params[1].isGPR());
            auto dst = params[0].gpr();
            auto a = params[1].gpr();
            auto branch = jit.branchTest64(CCallHelpers::Zero, a, MacroAssembler::TrustedImm64(0xFFFFFFFF00000000));
            jit.breakpoint();
            jit.breakpoint(0);
            jit.breakpoint(1);
            jit.breakpoint(2);
            branch.link(&jit);
            jit.move(a, dst);
        });

        replaceWithNew<Value>(Identity, m_value->origin(), patchpoint);
```

* Source/JavaScriptCore/b3/air/AirOpcode.opcodes:

Canonical link: https://commits.webkit.org/276829@main

f74efe4

Misc iOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 wincairo
✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ❌ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt ✅ 🧪 mac-wk1 ✅ 🛠 wpe-skia
✅ 🛠 🧪 jsc ✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64 ✅ 🛠 tv ✅ 🧪 mac-AS-debug-wk2 ✅ 🧪 gtk-wk2
✅ 🛠 tv-sim ✅ 🧪 api-gtk
✅ 🛠 watch ✅ 🛠 jsc-armv7
✅ 🛠 🧪 unsafe-merge ✅ 🛠 watch-sim ✅ 🧪 jsc-armv7-tests

@justinmichaud justinmichaud requested a review from a team as a code owner March 29, 2024 00:21
@justinmichaud justinmichaud self-assigned this Mar 29, 2024
@justinmichaud justinmichaud added the JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues. label Mar 29, 2024
Copy link
Member

@Constellation Constellation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

r=me

@justinmichaud justinmichaud added the safe-merge-queue Applied to automatically send a pull-request to merge-queue after passing EWS checks label Mar 29, 2024
@webkit-ews-buildbot
Copy link
Collaborator

Failed api-wpe checks. Please resolve failures and re-apply safe-merge-queue label.

Rejecting #26593 from merge queue.

@webkit-ews-buildbot webkit-ews-buildbot added merging-blocked Applied to prevent a change from being merged and removed safe-merge-queue Applied to automatically send a pull-request to merge-queue after passing EWS checks labels Mar 29, 2024
@webkit-ews-buildbot
Copy link
Collaborator

Safe-Merge-Queue: Build #16324.

@MenloDorian
Copy link

The api-wpe test failure is unrelated.

@MenloDorian MenloDorian added unsafe-merge-queue Applied to send a pull request to merge-queue, but skip building and testing and removed merging-blocked Applied to prevent a change from being merged labels Mar 29, 2024
https://bugs.webkit.org/show_bug.cgi?id=271866
rdar://122959696

Reviewed by Yusuke Suzuki.

This fixes a hang in Google Meet when applying the Black Noir filter.

Suppose we have:

```
@A = Load8SignedExtendTo32(@x)

@b = Trunc(ZExt32(@A))
```

B3 reduceStrength will convert @b to @A. The Air register allocator will
see that we ZDef 64 bits in @A, but on ARM64, we actually sign-extend them.

This was caught by changing reduceStrength:

```
case Trunc:
    // Turn this: Trunc(SExt32(value)) or Trunc(ZExt32(value))
    // Into this: value
    if (m_value->child(0)->opcode() == SExt32 || m_value->child(0)->opcode() == ZExt32) {
        auto* value = m_value->child(0)->child(0);
        auto* patchpoint = m_insertionSet.insert<PatchpointValue>(
            m_index, m_value->type(), m_value->origin());

        patchpoint->effects = Effects();
        patchpoint->effects.reads = HeapRange::top();
        patchpoint->effects.exitsSideways = true;

        patchpoint->append(value);
        patchpoint->setGenerator([&] (CCallHelpers& jit, const StackmapGenerationParams& params) {
            RELEASE_ASSERT(params.size() == 2);
            RELEASE_ASSERT(params[0].isGPR());
            RELEASE_ASSERT(params[1].isGPR());
            auto dst = params[0].gpr();
            auto a = params[1].gpr();
            auto branch = jit.branchTest64(CCallHelpers::Zero, a, MacroAssembler::TrustedImm64(0xFFFFFFFF00000000));
            jit.breakpoint();
            jit.breakpoint(0);
            jit.breakpoint(1);
            jit.breakpoint(2);
            branch.link(&jit);
            jit.move(a, dst);
        });

        replaceWithNew<Value>(Identity, m_value->origin(), patchpoint);
```

* Source/JavaScriptCore/b3/air/AirOpcode.opcodes:

Canonical link: https://commits.webkit.org/276829@main
@webkit-commit-queue webkit-commit-queue force-pushed the eng/Signed-loads-should-not-zero-def-their-destination- branch from f74efe4 to 5838997 Compare March 29, 2024 16:51
@webkit-commit-queue
Copy link
Collaborator

Committed 276829@main (5838997): https://commits.webkit.org/276829@main

Reviewed commits have been landed. Closing PR #26593 and removing active labels.

@webkit-commit-queue webkit-commit-queue merged commit 5838997 into WebKit:main Mar 29, 2024
@webkit-commit-queue webkit-commit-queue removed the unsafe-merge-queue Applied to send a pull request to merge-queue, but skip building and testing label Mar 29, 2024
@justinmichaud justinmichaud deleted the eng/Signed-loads-should-not-zero-def-their-destination- branch April 12, 2024 20:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues.
Projects
None yet
6 participants