The Tor Browser: js/src/jit/ParallelFunctions.cpp@129ffea94266 (annotated)

js/src/jit/ParallelFunctions.cpp@129ffea94266 (annotated)

js/src/jit/ParallelFunctions.cpp

Sat, 03 Jan 2015 20:18:00 +0100

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Sat, 03 Jan 2015 20:18:00 +0100
branch: TOR_BUG_3246
changeset 7: 129ffea94266
permissions: -rw-r--r--

Conditionally enable double key logic according to:
private browsing mode or privacy.thirdparty.isolate preference and
implement in GetCookieStringCommon and FindCookie where it counts...
With some reservations of how to convince FindCookie users to test
condition and pass a nullptr when disabling double key logic.

 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "jit/ParallelFunctions.h"
 #include "builtin/TypedObject.h"
 #include "jit/arm/Simulator-arm.h"
 #include "vm/ArrayObject.h"
 #include "jsgcinlines.h"
 #include "jsobjinlines.h"
 using namespace js;
 using namespace jit;
 using parallel::Spew;
 using parallel::SpewOps;
 using parallel::SpewBailouts;
 using parallel::SpewBailoutIR;
 // Load the current thread context.
 ForkJoinContext *
 jit::ForkJoinContextPar()
 {
     return ForkJoinContext::current();
 }
 // NewGCThingPar() is called in place of NewGCThing() when executing
 // parallel code.  It uses the ArenaLists for the current thread and
 // allocates from there.
 JSObject *
 jit::NewGCThingPar(ForkJoinContext *cx, gc::AllocKind allocKind)
 {
     JS_ASSERT(ForkJoinContext::current() == cx);
     return js::NewGCObject<NoGC>(cx, allocKind, 0, gc::TenuredHeap);
 }
 bool
 jit::ParallelWriteGuard(ForkJoinContext *cx, JSObject *object)
 {
     // Implements the most general form of the write guard, which is
     // suitable for writes to any object O. There are two cases to
     // consider and test for:
     //
     // 1. Writes to thread-local memory are safe. Thread-local memory
     //    is defined as memory allocated by the current thread.
     //    The definition of the PJS API guarantees that such memory
     //    cannot have escaped to other parallel threads.
     //
     // 2. Writes into the output buffer are safe. Some PJS operations
     //    supply an out pointer into the final target buffer. The design
     //    of the API ensures that this out pointer is always pointing
     //    at a fresh region of the buffer that is not accessible to
     //    other threads. Thus, even though this output buffer has not
     //    been created by the current thread, it is writable.
     //
     // There are some subtleties to consider:
     //
     // A. Typed objects and typed arrays are just views onto a base buffer.
     //    For the purposes of guarding parallel writes, it is not important
     //    whether the *view* is thread-local -- what matters is whether
     //    the *underlying buffer* is thread-local.
     //
     // B. With regard to the output buffer, we have to be careful
     //    because of the potential for sequential iterations to be
     //    intermingled with parallel ones. During a sequential
     //    iteration, the out pointer could escape into global
     //    variables and so forth, and thus be used during later
     //    parallel operations. However, those out pointers must be
     //    pointing to distinct regions of the final output buffer than
     //    the ones that are currently being written, so there is no
     //    harm done in letting them be read (but not written).
     //
     //    In order to be able to distinguish escaped out pointers from
     //    prior iterations and the proper out pointers from the
     //    current iteration, we always track a *target memory region*
     //    (which is a span of bytes within the output buffer) and not
     //    just the output buffer itself.
     JS_ASSERT(ForkJoinContext::current() == cx);
     if (object->is<TypedObject>()) {
         TypedObject &typedObj = object->as<TypedObject>();
         // Note: check target region based on `typedObj`, not the owner.
         // This is because `typedObj` may point to some subregion of the
         // owner and we only care if that *subregion* is within the
         // target region, not the entire owner.
         if (IsInTargetRegion(cx, &typedObj))
             return true;
         // Also check whether owner is thread-local.
         ArrayBufferObject &owner = typedObj.owner();
         return cx->isThreadLocal(&owner);
     }
     // For other kinds of writable objects, must be thread-local.
     return cx->isThreadLocal(object);
 }
 // Check that |object| (which must be a typed typedObj) maps
 // to memory in the target region.
 //
 // For efficiency, we assume that all handles which the user has
 // access to are either entirely within the target region or entirely
 // without, but not straddling the target region nor encompassing
 // it. This invariant is maintained by the PJS APIs, where the target
 // region and handles are always elements of the same output array.
 bool
 jit::IsInTargetRegion(ForkJoinContext *cx, TypedObject *typedObj)
 {
     JS_ASSERT(typedObj->is<TypedObject>()); // in case JIT supplies something bogus
     uint8_t *typedMem = typedObj->typedMem();
     return (typedMem >= cx->targetRegionStart &&
             typedMem <  cx->targetRegionEnd);
 }
 #ifdef DEBUG
 static void
 printTrace(const char *prefix, struct IonLIRTraceData *cached)
 {
     fprintf(stderr, "%s / Block %3u / LIR %3u / Mode %u / LIR %s\n",
             prefix,
             cached->blockIndex, cached->lirIndex, cached->execModeInt, cached->lirOpName);
 }
 static struct IonLIRTraceData seqTraceData;
 #endif
 void
 jit::TraceLIR(IonLIRTraceData *current)
 {
 #ifdef DEBUG
     static enum { NotSet, All, Bailouts } traceMode;
     // If you set IONFLAGS=trace, this function will be invoked before every LIR.
     //
     // You can either modify it to do whatever you like, or use gdb scripting.
     // For example:
     //
     // break TraceLIR
     // commands
     // continue
     // exit
     if (traceMode == NotSet) {
         // Racy, but that's ok.
         const char *env = getenv("IONFLAGS");
         if (strstr(env, "trace-all"))
             traceMode = All;
         else
             traceMode = Bailouts;
     }
     IonLIRTraceData *cached;
     if (current->execModeInt == 0)
         cached = &seqTraceData;
     else
         cached = &ForkJoinContext::current()->traceData;
     if (current->blockIndex == 0xDEADBEEF) {
         if (current->execModeInt == 0)
             printTrace("BAILOUT", cached);
         else
             SpewBailoutIR(cached);
     }
     memcpy(cached, current, sizeof(IonLIRTraceData));
     if (traceMode == All)
         printTrace("Exec", cached);
 #endif
 }
 bool
 jit::CheckOverRecursedPar(ForkJoinContext *cx)
 {
     JS_ASSERT(ForkJoinContext::current() == cx);
     int stackDummy_;
     // When an interrupt is requested, the main thread stack limit is
     // overwritten with a sentinel value that brings us here.
     // Therefore, we must check whether this is really a stack overrun
     // and, if not, check whether an interrupt was requested.
     //
     // When not on the main thread, we don't overwrite the stack
     // limit, but we do still call into this routine if the interrupt
     // flag is set, so we still need to double check.
 #ifdef JS_ARM_SIMULATOR
     if (Simulator::Current()->overRecursed()) {
         cx->bailoutRecord->setCause(ParallelBailoutOverRecursed);
         return false;
     }
 #endif
     uintptr_t realStackLimit;
     if (cx->isMainThread())
         realStackLimit = GetNativeStackLimit(cx);
     else
         realStackLimit = cx->perThreadData->jitStackLimit;
     if (!JS_CHECK_STACK_SIZE(realStackLimit, &stackDummy_)) {
         cx->bailoutRecord->setCause(ParallelBailoutOverRecursed);
         return false;
     }
     return InterruptCheckPar(cx);
 }
 bool
 jit::InterruptCheckPar(ForkJoinContext *cx)
 {
     JS_ASSERT(ForkJoinContext::current() == cx);
     bool result = cx->check();
     if (!result) {
         // Do not set the cause here.  Either it was set by this
         // thread already by some code that then triggered an abort,
         // or else we are just picking up an abort from some other
         // thread.  Either way we have nothing useful to contribute so
         // we might as well leave our bailout case unset.
         return false;
     }
     return true;
 }
 JSObject *
 jit::ExtendArrayPar(ForkJoinContext *cx, JSObject *array, uint32_t length)
 {
     JSObject::EnsureDenseResult res =
         array->ensureDenseElementsPreservePackedFlag(cx, 0, length);
     if (res != JSObject::ED_OK)
         return nullptr;
     return array;
 }
 bool
 jit::SetPropertyPar(ForkJoinContext *cx, HandleObject obj, HandlePropertyName name,
                     HandleValue value, bool strict, jsbytecode *pc)
 {
     JS_ASSERT(cx->isThreadLocal(obj));
     if (*pc == JSOP_SETALIASEDVAR) {
         // See comment in jit::SetProperty.
         Shape *shape = obj->nativeLookupPure(name);
         JS_ASSERT(shape && shape->hasSlot());
         return obj->nativeSetSlotIfHasType(shape, value);
     }
     // Fail early on hooks.
     if (obj->getOps()->setProperty)
         return TP_RETRY_SEQUENTIALLY;
     RootedValue v(cx, value);
     RootedId id(cx, NameToId(name));
     return baseops::SetPropertyHelper<ParallelExecution>(cx, obj, obj, id, baseops::Qualified, &v,
                                                          strict);
 }
 bool
 jit::SetElementPar(ForkJoinContext *cx, HandleObject obj, HandleValue index, HandleValue value,
                    bool strict)
 {
     RootedId id(cx);
     if (!ValueToIdPure(index, id.address()))
         return false;
     // SetObjectElementOperation, the sequential version, has several checks
     // for certain deoptimizing behaviors, such as marking having written to
     // holes and non-indexed element accesses. We don't do that here, as we
     // can't modify any TI state anyways. If we need to add a new type, we
     // would bail out.
     RootedValue v(cx, value);
     return baseops::SetPropertyHelper<ParallelExecution>(cx, obj, obj, id, baseops::Qualified, &v,
                                                          strict);
 }
 bool
 jit::SetDenseElementPar(ForkJoinContext *cx, HandleObject obj, int32_t index, HandleValue value,
                         bool strict)
 {
     RootedValue indexVal(cx, Int32Value(index));
     return SetElementPar(cx, obj, indexVal, value, strict);
 }
 JSString *
 jit::ConcatStringsPar(ForkJoinContext *cx, HandleString left, HandleString right)
 {
     return ConcatStrings<NoGC>(cx, left, right);
 }
 JSFlatString *
 jit::IntToStringPar(ForkJoinContext *cx, int i)
 {
     return Int32ToString<NoGC>(cx, i);
 }
 JSString *
 jit::DoubleToStringPar(ForkJoinContext *cx, double d)
 {
     return NumberToString<NoGC>(cx, d);
 }
 JSString *
 jit::PrimitiveToStringPar(ForkJoinContext *cx, HandleValue input)
 {
     // All other cases are handled in assembly.
     JS_ASSERT(input.isDouble() || input.isInt32());
     if (input.isInt32())
         return Int32ToString<NoGC>(cx, input.toInt32());
     return NumberToString<NoGC>(cx, input.toDouble());
 }
 bool
 jit::StringToNumberPar(ForkJoinContext *cx, JSString *str, double *out)
 {
     return StringToNumber(cx, str, out);
 }
 #define PAR_RELATIONAL_OP(OP, EXPECTED)                                         \
 do {                                                                            \
     /* Optimize for two int-tagged operands (typical loop control). */          \
     if (lhs.isInt32() && rhs.isInt32()) {                                       \
         *res = (lhs.toInt32() OP rhs.toInt32()) == EXPECTED;                    \
     } else if (lhs.isNumber() && rhs.isNumber()) {                              \
         double l = lhs.toNumber(), r = rhs.toNumber();                          \
         *res = (l OP r) == EXPECTED;                                            \
     } else if (lhs.isBoolean() && rhs.isBoolean()) {                            \
         bool l = lhs.toBoolean();                                               \
         bool r = rhs.toBoolean();                                               \
         *res = (l OP r) == EXPECTED;                                            \
     } else if (lhs.isBoolean() && rhs.isNumber()) {                             \
         bool l = lhs.toBoolean();                                               \
         double r = rhs.toNumber();                                              \
         *res = (l OP r) == EXPECTED;                                            \
     } else if (lhs.isNumber() && rhs.isBoolean()) {                             \
         double l = lhs.toNumber();                                              \
         bool r = rhs.toBoolean();                                               \
         *res = (l OP r) == EXPECTED;                                            \
     } else {                                                                    \
         int32_t vsZero;                                                         \
         if (!CompareMaybeStringsPar(cx, lhs, rhs, &vsZero))                  \
             return false;                                                       \
         *res = (vsZero OP 0) == EXPECTED;                                       \
     }                                                                           \
     return true;                                                                \
 } while(0)
 static bool
 CompareStringsPar(ForkJoinContext *cx, JSString *left, JSString *right, int32_t *res)
 {
     ScopedThreadSafeStringInspector leftInspector(left);
     ScopedThreadSafeStringInspector rightInspector(right);
     if (!leftInspector.ensureChars(cx) || !rightInspector.ensureChars(cx))
         return false;
     *res = CompareChars(leftInspector.chars(), left->length(),
                         rightInspector.chars(), right->length());
     return true;
 }
 static bool
 CompareMaybeStringsPar(ForkJoinContext *cx, HandleValue v1, HandleValue v2, int32_t *res)
 {
     if (!v1.isString())
         return false;
     if (!v2.isString())
         return false;
     return CompareStringsPar(cx, v1.toString(), v2.toString(), res);
 }
 template<bool Equal>
 bool
 LooselyEqualImplPar(ForkJoinContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, bool *res)
 {
     PAR_RELATIONAL_OP(==, Equal);
 }
 bool
 js::jit::LooselyEqualPar(ForkJoinContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, bool *res)
 {
     return LooselyEqualImplPar<true>(cx, lhs, rhs, res);
 }
 bool
 js::jit::LooselyUnequalPar(ForkJoinContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, bool *res)
 {
     return LooselyEqualImplPar<false>(cx, lhs, rhs, res);
 }
 template<bool Equal>
 bool
 StrictlyEqualImplPar(ForkJoinContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, bool *res)
 {
     if (lhs.isNumber()) {
         if (rhs.isNumber()) {
             *res = (lhs.toNumber() == rhs.toNumber()) == Equal;
             return true;
         }
     } else if (lhs.isBoolean()) {
         if (rhs.isBoolean()) {
             *res = (lhs.toBoolean() == rhs.toBoolean()) == Equal;
             return true;
         }
     } else if (lhs.isNull()) {
         if (rhs.isNull()) {
             *res = Equal;
             return true;
         }
     } else if (lhs.isUndefined()) {
         if (rhs.isUndefined()) {
             *res = Equal;
             return true;
         }
     } else if (lhs.isObject()) {
         if (rhs.isObject()) {
             *res = (lhs.toObjectOrNull() == rhs.toObjectOrNull()) == Equal;
             return true;
         }
     } else if (lhs.isString()) {
         if (rhs.isString())
             return LooselyEqualImplPar<Equal>(cx, lhs, rhs, res);
     }
     *res = false;
     return true;
 }
 bool
 js::jit::StrictlyEqualPar(ForkJoinContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, bool *res)
 {
     return StrictlyEqualImplPar<true>(cx, lhs, rhs, res);
 }
 bool
 js::jit::StrictlyUnequalPar(ForkJoinContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, bool *res)
 {
     return StrictlyEqualImplPar<false>(cx, lhs, rhs, res);
 }
 bool
 js::jit::LessThanPar(ForkJoinContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, bool *res)
 {
     PAR_RELATIONAL_OP(<, true);
 }
 bool
 js::jit::LessThanOrEqualPar(ForkJoinContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, bool *res)
 {
     PAR_RELATIONAL_OP(<=, true);
 }
 bool
 js::jit::GreaterThanPar(ForkJoinContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, bool *res)
 {
     PAR_RELATIONAL_OP(>, true);
 }
 bool
 js::jit::GreaterThanOrEqualPar(ForkJoinContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, bool *res)
 {
     PAR_RELATIONAL_OP(>=, true);
 }
 template<bool Equal>
 bool
 StringsEqualImplPar(ForkJoinContext *cx, HandleString lhs, HandleString rhs, bool *res)
 {
     int32_t vsZero;
     bool ret = CompareStringsPar(cx, lhs, rhs, &vsZero);
     if (ret != true)
         return ret;
     *res = (vsZero == 0) == Equal;
     return true;
 }
 bool
 js::jit::StringsEqualPar(ForkJoinContext *cx, HandleString v1, HandleString v2, bool *res)
 {
     return StringsEqualImplPar<true>(cx, v1, v2, res);
 }
 bool
 js::jit::StringsUnequalPar(ForkJoinContext *cx, HandleString v1, HandleString v2, bool *res)
 {
     return StringsEqualImplPar<false>(cx, v1, v2, res);
 }
 bool
 jit::BitNotPar(ForkJoinContext *cx, HandleValue in, int32_t *out)
 {
     if (in.isObject())
         return false;
     int i;
     if (!NonObjectToInt32(cx, in, &i))
         return false;
     *out = ~i;
     return true;
 }
 #define BIT_OP(OP)                                                      \
     JS_BEGIN_MACRO                                                      \
     int32_t left, right;                                                \
     if (lhs.isObject() || rhs.isObject())                               \
         return false;                                                   \
     if (!NonObjectToInt32(cx, lhs, &left) ||                            \
         !NonObjectToInt32(cx, rhs, &right))                             \
     {                                                                   \
         return false;                                                   \
     }                                                                   \
     *out = (OP);                                                        \
     return true;                                                        \
     JS_END_MACRO
 bool
 jit::BitXorPar(ForkJoinContext *cx, HandleValue lhs, HandleValue rhs, int32_t *out)
 {
     BIT_OP(left ^ right);
 }
 bool
 jit::BitOrPar(ForkJoinContext *cx, HandleValue lhs, HandleValue rhs, int32_t *out)
 {
     BIT_OP(left | right);
 }
 bool
 jit::BitAndPar(ForkJoinContext *cx, HandleValue lhs, HandleValue rhs, int32_t *out)
 {
     BIT_OP(left & right);
 }
 bool
 jit::BitLshPar(ForkJoinContext *cx, HandleValue lhs, HandleValue rhs, int32_t *out)
 {
     BIT_OP(uint32_t(left) << (right & 31));
 }
 bool
 jit::BitRshPar(ForkJoinContext *cx, HandleValue lhs, HandleValue rhs, int32_t *out)
 {
     BIT_OP(left >> (right & 31));
 }
 #undef BIT_OP
 bool
 jit::UrshValuesPar(ForkJoinContext *cx, HandleValue lhs, HandleValue rhs,
                    MutableHandleValue out)
 {
     uint32_t left;
     int32_t right;
     if (lhs.isObject() || rhs.isObject())
         return false;
     if (!NonObjectToUint32(cx, lhs, &left) || !NonObjectToInt32(cx, rhs, &right))
         return false;
     left >>= right & 31;
     out.setNumber(uint32_t(left));
     return true;
 }
 void
 jit::AbortPar(ParallelBailoutCause cause, JSScript *outermostScript, JSScript *currentScript,
               jsbytecode *bytecode)
 {
     // Spew before asserts to help with diagnosing failures.
     Spew(SpewBailouts,
          "Parallel abort with cause %d in %p:%s:%d "
          "(%p:%s:%d at line %d)",
          cause,
          outermostScript, outermostScript->filename(), outermostScript->lineno(),
          currentScript, currentScript->filename(), currentScript->lineno(),
          (currentScript ? PCToLineNumber(currentScript, bytecode) : 0));
     JS_ASSERT(InParallelSection());
     JS_ASSERT(outermostScript != nullptr);
     JS_ASSERT(currentScript != nullptr);
     JS_ASSERT(outermostScript->hasParallelIonScript());
     ForkJoinContext *cx = ForkJoinContext::current();
     JS_ASSERT(cx->bailoutRecord->depth == 0);
     cx->bailoutRecord->setCause(cause, outermostScript, currentScript, bytecode);
 }
 void
 jit::PropagateAbortPar(JSScript *outermostScript, JSScript *currentScript)
 {
     Spew(SpewBailouts,
          "Propagate parallel abort via %p:%s:%d (%p:%s:%d)",
          outermostScript, outermostScript->filename(), outermostScript->lineno(),
          currentScript, currentScript->filename(), currentScript->lineno());
     JS_ASSERT(InParallelSection());
     JS_ASSERT(outermostScript->hasParallelIonScript());
     outermostScript->parallelIonScript()->setHasUncompiledCallTarget();
     ForkJoinContext *cx = ForkJoinContext::current();
     if (currentScript)
         cx->bailoutRecord->addTrace(currentScript, nullptr);
 }
 void
 jit::CallToUncompiledScriptPar(JSObject *obj)
 {
     JS_ASSERT(InParallelSection());
 #ifdef DEBUG
     static const int max_bound_function_unrolling = 5;
     if (!obj->is<JSFunction>()) {
         Spew(SpewBailouts, "Call to non-function");
         return;
     }
     JSFunction *func = &obj->as<JSFunction>();
     if (func->hasScript()) {
         JSScript *script = func->nonLazyScript();
         Spew(SpewBailouts, "Call to uncompiled script: %p:%s:%d",
              script, script->filename(), script->lineno());
     } else if (func->isInterpretedLazy()) {
         Spew(SpewBailouts, "Call to uncompiled lazy script");
     } else if (func->isBoundFunction()) {
         int depth = 0;
         JSFunction *target = &func->getBoundFunctionTarget()->as<JSFunction>();
         while (depth < max_bound_function_unrolling) {
             if (target->hasScript())
                 break;
             if (target->isBoundFunction())
                 target = &target->getBoundFunctionTarget()->as<JSFunction>();
             depth--;
         }
         if (target->hasScript()) {
             JSScript *script = target->nonLazyScript();
             Spew(SpewBailouts, "Call to bound function leading (depth: %d) to script: %p:%s:%d",
                  depth, script, script->filename(), script->lineno());
         } else {
             Spew(SpewBailouts, "Call to bound function (excessive depth: %d)", depth);
         }
     } else {
         JS_ASSERT(func->isNative());
         Spew(SpewBailouts, "Call to native function");
     }
 #endif
 }
 JSObject *
 jit::InitRestParameterPar(ForkJoinContext *cx, uint32_t length, Value *rest,
                           HandleObject templateObj, HandleObject res)
 {
     // In parallel execution, we should always have succeeded in allocation
     // before this point. We can do the allocation here like in the sequential
     // path, but duplicating the initGCThing logic is too tedious.
     JS_ASSERT(res);
     JS_ASSERT(res->is<ArrayObject>());
     JS_ASSERT(!res->getDenseInitializedLength());
     JS_ASSERT(res->type() == templateObj->type());
     if (length > 0) {
         JSObject::EnsureDenseResult edr =
             res->ensureDenseElementsPreservePackedFlag(cx, 0, length);
         if (edr != JSObject::ED_OK)
             return nullptr;
         res->initDenseElementsUnbarriered(0, rest, length);
         res->as<ArrayObject>().setLengthInt32(length);
     }
     return res;
 }

The Tor Browser / annotate

js/src/jit/ParallelFunctions.cpp@129ffea94266 (annotated)

js/src/jit/ParallelFunctions.cpp