Bug 1889049 - Avoid writing to input reg in toHashableString a=RyanVM

Original Revision: https://phabricator.services.mozilla.com/D206560 Differential Revision: https://phabricator.services.mozilla.com/D206709
dothq · Apr 6, 2024 · 9a0f9a8 · 9a0f9a8
1 parent 4e605bb
commit 9a0f9a8
Show file tree

Hide file tree

Showing 4 changed files with 7 additions and 5 deletions.
diff --git a/js/src/jit/CacheIRCompiler.cpp b/js/src/jit/CacheIRCompiler.cpp
@@ -2834,7 +2834,7 @@ bool CacheIRCompiler::emitStringToAtom(StringOperandId stringId) {
   masm.branchTest32(Assembler::NonZero, Address(str, JSString::offsetOfFlags()),
                     Imm32(JSString::ATOM_BIT), &done);
 
-  masm.lookupStringInAtomCacheLastLookups(str, scratch, &vmCall);
+  masm.lookupStringInAtomCacheLastLookups(str, scratch, str, &vmCall);
   masm.jump(&done);
 
   masm.bind(&vmCall);

diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
@@ -20237,7 +20237,8 @@ void CodeGenerator::visitToHashableString(LToHashableString* ins) {
                     Address(input, JSString::offsetOfFlags()),
                     Imm32(JSString::ATOM_BIT), &isAtom);
 
-  masm.lookupStringInAtomCacheLastLookups(input, output, ool->entry());
+  masm.lookupStringInAtomCacheLastLookups(input, output, output, ool->entry());
+  masm.jump(ool->rejoin());
   masm.bind(&isAtom);
   masm.movePtr(input, output);
   masm.bind(ool->rejoin());

diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp
@@ -2661,6 +2661,7 @@ void MacroAssembler::loadMegamorphicSetPropCache(Register dest) {
 
 void MacroAssembler::lookupStringInAtomCacheLastLookups(Register str,
                                                         Register scratch,
+                                                        Register output,
                                                         Label* fail) {
   Label found;
 
@@ -2680,7 +2681,7 @@ void MacroAssembler::lookupStringInAtomCacheLastLookups(Register str,
   // and jump back up to our usual atom handling code
   bind(&found);
   size_t atomOffset = StringToAtomCache::LastLookup::offsetOfAtom();
-  loadPtr(Address(scratch, atomOffset), str);
+  loadPtr(Address(scratch, atomOffset), output);
 }
 
 void MacroAssembler::loadAtomHash(Register id, Register outHash, Label* done) {
@@ -2740,7 +2741,7 @@ void MacroAssembler::loadAtomOrSymbolAndHash(ValueOperand value, Register outId,
   loadAtomHash(outId, outHash, &done);
 
   bind(&nonAtom);
-  lookupStringInAtomCacheLastLookups(outId, outHash, cacheMiss);
+  lookupStringInAtomCacheLastLookups(outId, outHash, outId, cacheMiss);
   jump(&atom);
 
   bind(&done);

diff --git a/js/src/jit/MacroAssembler.h b/js/src/jit/MacroAssembler.h
@@ -5602,7 +5602,7 @@ class MacroAssembler : public MacroAssemblerSpecific {
 
   void loadMegamorphicCache(Register dest);
   void lookupStringInAtomCacheLastLookups(Register str, Register scratch,
-                                          Label* fail);
+                                          Register output, Label* fail);
   void loadMegamorphicSetPropCache(Register dest);
 
   void loadAtomOrSymbolAndHash(ValueOperand value, Register outId,