tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

bce-x64-ion-codegen.js (2331B)


      1 // |jit-test| --wasm-compiler=optimizing; --disable-wasm-huge-memory; --spectre-mitigations=off; skip-if: !hasDisassembler() || wasmCompileMode() != "ion" || !getBuildConfiguration("x64") || getBuildConfiguration("simulator") || getJitCompilerOptions()["ion.check-range-analysis"]; include:codegen-x64-test.js
      2 
      3 // Spectre mitigation is disabled above to make the generated code simpler to
      4 // match; ion.check-range-analysis makes a hash of the code and makes testing
      5 // pointless.
      6 
      7 // White-box testing of bounds check elimination on 64-bit systems.
      8 //
      9 // This is probably fairly brittle, but BCE on 64-bit platforms regressed (bug
     10 // 1735207) without us noticing, so it's not like we can do without these tests.
     11 //
     12 // See also bce-x86-ion-codegen.js.
     13 //
     14 // If this turns out to be too brittle to be practical then an alternative to
     15 // testing the output code is to do what we do for SIMD, record (in a log or
     16 // buffer of some kind) that certain optimizations triggered, and then check the
     17 // log.
     18 
     19 var memTypes = ['i32', 'i64'];
     20 
     21 for ( let memType of memTypes ) {
     22    // Make sure the check for the second load is removed: the two load
     23    // instructions should appear back-to-back in the output.
     24    codegenTestX64_adhoc(
     25 `(module
     26   (memory ${memType} 1)
     27   (func (export "f") (param ${memType}) (result i32)
     28     (local ${memType})
     29     (local.set 1 (${memType}.add (local.get 0) (${memType}.const 8)))
     30     (i32.load (local.get 1))
     31     drop
     32     (i32.load (local.get 1))))`,
     33    'f', `
     34 (movq 0x08\\(%r..\\), %r..\ncmp %r.., %r..|cmpq 0x08\\(%r..\\), %r..)
     35 jnb 0x00000000000000..
     36 movl \\(%r..,%r..,1\\), %e..
     37 movl \\(%r..,%r..,1\\), %eax`,
     38        {no_prefix:true});
     39 
     40    // Make sure constant indices below the heap minimum do not require a bounds
     41    // check.
     42    codegenTestX64_adhoc(
     43 `(module
     44   (memory ${memType} 1)
     45   (func (export "f") (result i32)
     46     (i32.load (${memType}.const 16))))`,
     47    'f',
     48    `movl 0x10\\(%r15\\), %eax`);
     49 
     50    // Ditto, even at the very limit of the known heap, extending into the guard
     51    // page.  This is an OOB access, of course, but it needs no explicit bounds
     52    // check.
     53    codegenTestX64_adhoc(
     54 `(module
     55   (memory ${memType} 1)
     56   (func (export "f") (result i32)
     57     (i32.load (${memType}.const 65535))))`,
     58    'f',
     59 `
     60 mov \\$0xFFFF, %eax
     61 movl \\(%r15,%rax,1\\), %eax`);
     62 }