486325 - TraceMonkey: Fixes for patched branches on ARM.

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jacob Bramley [:jbramley]]

Attachment: Fix branch patching behaviour for corner-cases.

* For conditional branches where _nSlot and _nIns are not on the same page, a branch is emitted to jump over a literal in the instruction stream. However, the generated branch jumped to the wrong address as the PC on ARM is 8 bytes ahead of the current instruction address.
  - I don't think this code is ever run, but I don't yet understand the code well enough to be sure. If it is run, it will only occur on corner cases, so it will be hard to trigger.

* A check ensured that _nIns and _nSlot are on the same page, but _nIns is pre-decremented before being written to so it will start off on a different page. I have corrected this check.
  - Note that there is some code elsewhere that deliberately wastes a word at the top of the page because something is checking or writing to _nIns before decrementing it. That could be this check, though I haven't yet investigated it and there may be others.

* The branch generation code in B_cond_chk confused me as it isn't clear what the generated instructions were from the source. I added a comment to explain the different types of branch that it can emit, and it makes sense to leave it in the code for others to benefit from, so that is also in my patch.

* If the branch target is passed as 0, the real target is unknown. If _nIns is within 32MB of 0, B_cond_chk would attempt to insert a simple B instruction, and this would fail later when the branch was patched. This doesn't happen for me on Linux, but it is quite possible that it could happen on other platforms.

* I've also added a couple of asserts in case an unsupported (conditional) patching request is made.

Comment 1

[Jacob Bramley [:jbramley]]

Attachment: Re-synchronization with tree.

Comment 2

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/1788ec6fdc1f