1944797 - LIRGeneratorShared::use allows MIRType::Int64 when INT64_PIECES is 2

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[André Bargull [:anba]]

https://searchfox.org/mozilla-central/rev/dd8b64a6198ff599a5eb2ca096845ebd6997457f/js/src/jit/shared/Lowering-shared-inl.h#25-32:

  // It is illegal to call use() on an instruction with two defs.
#if BOX_PIECES > 1
  MOZ_ASSERT(mir->type() != MIRType::Value);
#endif
#if INT64_PIECES > 1
  MOZ_ASSERT(mir->type() != MIRType::Int64);
#endif

This code incorrectly allows MIRType::Int64 when INT64_PIECES is 2. (The BOX_PIECES > 1 check works correctly, though.)

Hint: Check how INT64_PIECES and BOX_PIECES are defined.

Comment 1

[André Bargull [:anba]]

Attachment: Bug 1944797 - Part 1: Add LIRGeneratorShared::useLowWord to allocate register for int64 low-word. r=jandem!

LIRGeneratorShared::use allowed to allocate a register for the low-word of an
int64 value, because the INT64_PIECES > 1 assertion didn't propery work. (The
assertion was wrapped with #if INT64_PIECES > 1, but INT64_PIECES is a C++
constant and not a macro processor #define, so #if INT64_PIECES > 1 always
evaluated to false.)

Add LIRGeneratorShared::useLowWord for 32-bit targets to provide the correct
way to allocate a register for an int64 low-word. And then update the three places
which only worked due to the incorrect assertion:

• lowerForShiftInt64 on x86 and arm32.
• visitWasmWrapU32Index when JS_64BIT is false.
• visitWasmStore for x86 when the input is an int64 value.

Comment 2

[André Bargull [:anba]]

Attachment: Bug 1944797 - Part 2: Align WasmStore for ARM32 with x86 code. r=jandem!

Align with the x86 code to only use LWasmStoreI64 the input is an Int64 value.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/12ba7ff7a874
Part 1: Add LIRGeneratorShared::useLowWord to allocate register for int64 low-word. r=jandem
https://hg.mozilla.org/integration/autoland/rev/636a1a175b01
Part 2: Align WasmStore for ARM32 with x86 code. r=jandem

Comment 4

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/12ba7ff7a874
https://hg.mozilla.org/mozilla-central/rev/636a1a175b01