- squirrelfish-dev - lists.macosforge.org

[webkit-help] [squirrelfish-dev] JIT Optimize Property Access failed
by talking1239＠gmail.com 05 Mar '13

05 Mar '13

Hi I enable ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS feature and find that it will crash when go back the home page after run follow test case, I think it is caused by the optimize propery access, so anyone know that it is caused by the arch related code or jit Infrastructure code? and if i disable ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS feature, it will run correctly. Any help explaining this would be much appreciated! test case: var Origin = new Object(); function Init() { Origin.V = [150] } for ( var i = 20; i <= 160; i *= 2 ) { //Init(i); } Init(); Init(); Init(); Origin = null; Callstack: JAVASCRIPTCORE!const JSC::JSArray::`vftable' + 2 bytes JAVASCRIPTCORE!JSC::Heap::sweep() line 1104 + 14 bytes JAVASCRIPTCORE!JSC::Heap::collectAllGarbage() line 1306 WEBKIT!WebCore::collect(void * 0x00000000) line 47 WEBKIT!WebCore::GCController::gcTimerFired(WebCore::Timer<WebCore::GCController> * 0x06a905a0 {m_object=??? m_function=??? }) line 70 WEBKIT!WebCore::Timer<WebCore::PageCache>::fired() line 98 + 20 bytes WEBKIT!WebCore::ThreadTimers::sharedTimerFiredInternal() line 115 WEBKIT!WebCore::ThreadTimers::sharedTimerFired() line 91 -- BGs/Felix Shi -- BGs/Felix Shi

2 3

Re: [squirrelfish] [webkit-dev] [webkit-help] [squirrelfish-dev] How to debug the JIT when it crash
by talking1239＠gmail.com 05 Mar '13

05 Mar '13

Hi Arunprasad, Thanks for your tips. My environment as following: CPU: SH4; SVN revision: 65000 OS: WINCE Tool Chain: MSVS+PB JS test case: I cann’t get the single js test case. But I can reproduce it as this steps[First access the http://image.baidu.com/, then access http://maps.google.de, wait 2-5 minitues, it will crash. The crash type is “access violation”]. I have try to debug it, find that the crash was caused by the jit, if we disable the JIT feature, the browser will not crash. As the test case is very complex and it is hard to be simplify, so I don’t know how to debug it. I try to print all the emitted instructions, but it is too many for me to analyze, after the instructions were emitted, the instruction will be repatch or relink, so anybody can give me some suggestion for how to debug it. Thanks. From: talking1239+caf_=talking1239=126.com(a)gmail.com [mailto:talking1239+caf_=talking1239=126.com@gmail.com] On Behalf Of Arunprasad Rajkumar Sent: 2013年3月4日 20:28 To: talking1239(a)gmail.com Cc: webkit-help(a)lists.webkit.org; squirrelfish-dev(a)lists.webkit.org; webkit-dev(a)lists.webkit.org Subject: Re: [webkit-dev] [webkit-help] [squirrelfish-dev] How to debug the JIT when it crash It will be good to mention CPU, WebKit SVN revision, OS, Tool Chain, JS test case name(Sun Spider,..?)..etc so that people can give more suggestions. On 4 March 2013 16:11, <talking1239(a)gmail.com> wrote: Hi All, apologies for the spam. right now I am trying to fix the jit crash bug, but I don't know how to start it, can anyone give me some suggestion? when javascript engine run some special test case, it will run crash. I have print all the emited instructions, but the instructions will be repatch or relink after it run, so is exist an way or steps for debugging it? Thanks in advance! -- BGs/Felix Shi _______________________________________________ webkit-dev mailing list webkit-dev(a)lists.webkit.org https://lists.webkit.org/mailman/listinfo/webkit-dev -- Arunprasad Rajkumar <http://in.linkedin.com/in/ararunprasad> http://in.linkedin.com/in/ararunprasad

1 0

[webkit-dev] [squirrelfish-dev][webkit-help]How to debug the Alignment Error in the JIT.
by talking1239＠gmail.com 27 Jan '13

27 Jan '13

Hi When I use my browser to load some web site, sometimes it will crash with the Alignment Error, and the callstack will pointe to the jit code. I don't know how to debug this issue? anyone can give me some suggestion for how to debug the alignment error of jit? How can I get the javascript code of last execution when system crash, where should I add the debug information? my platform is wince and cpu is SH4, and I get my webkit in 2011. Any help explaining this would be much appreciated! -- BGs/Felix Shi

1 0

Dumping jit with corresponding js source.
by eminemence＠gmail.com 27 Nov '12

27 Nov '12

Hi , Is there an existing feature to dump the generated jit with the corresponding js source code. It would be useful to understand how much jit is generated for each js statement? Also is there any in-built profiler in sfx? Thanks, Mayur Kankanwadi.

1 0

Re: [squirrelfish] [webkit-dev] Fwd: Understending LLInt
by wingoog moon 20 Nov '12

20 Nov '12

Sorry I just had a mistake, it is interprets code. but my question is how it actually does interpretation. In generateThunkWithJumpTo function there are 2 lines which I think actually start LLInt. jit.move(JSInterfaceJIT::TrustedImmPtr(bitwise_cast<void*>(target)), JSInterfaceJIT::regT0); jit.jump(JSInterfaceJIT::regT0); If I'm not mistaken this to lines do some preparations And actual interpretation begins only after JSValue result = JSValue::decode(ctiTrampoline(m_ref.code().executableAddress(), registerFile, callFrame, 0, 0, globalData)) in JITCode.h. Am I right? Thanks for attention! On Wed, Nov 14, 2012 at 8:11 PM, Filip Pizlo <fpizlo(a)apple.com> wrote: > The LLInt doesn't compile anything to native code, since its an > interpreter. It interprets the code instead. > > -Filip > > On Nov 14, 2012, at 3:19 AM, wingoog moon <wingoog91(a)gmail.com> wrote: > > > > ---------- Forwarded message ---------- > From: wingoog moon <wingoog91(a)gmail.com> > Date: Wed, Nov 14, 2012 at 1:51 AM > Subject: Understending LLInt > To: squirrelfish-dev(a)lists.webkit.org > > > Hi All. > > At which point LLInt starts to compile bytecode to the native code? > If I'm not mistaken it should be in prepareForExecution function, so I > guess that this part of code actually does translation from bytecode to > native code. > > if (JITCode::isBaselineCode(jitType)) { > // Start off in the low level interpreter. > LLInt::getEntrypoint(exec->globalData(), codeBlock.get(), jitCode); > codeBlock->setJITCode(jitCode, MacroAssemblerCodePtr()); > return true; > } > > But I just cannot figure out how translation actually is done. My only > assumption that this function only set up some native code, and actually > compilation begins when calling functions from native assembly code. > > Can anyone please explain LLInt working mechanism, any links or articles? > > > _______________________________________________ > webkit-dev mailing list > webkit-dev(a)lists.webkit.org > http://lists.webkit.org/mailman/listinfo/webkit-dev > >

1 1

Understending LLInt
by wingoog moon 13 Nov '12

13 Nov '12

Hi All. At which point LLInt starts to compile bytecode to the native code. If I'm not mistaken it should be in prepareForExecution function, so I guess that this part of code actually does translation from bytecode to native code. if (JITCode::isBaselineCode(jitType)) { // Start off in the low level interpreter. LLInt::getEntrypoint(exec->globalData(), codeBlock.get(), jitCode); codeBlock->setJITCode(jitCode, MacroAssemblerCodePtr()); return true; } But I just cannot figure out how translation actually is done. My only assumption that this function only set up some native code, and actually compilation begins from calling functions from native assembly code. Can anyone please explain LLInt working mechanism, any links or articles?

1 0

Help
by Leonard Euler 13 Nov '12

13 Nov '12

Hi. I know that assembly of globalCode generated in Interpreter.cpp:line 877,but I am can't find a concrete part of code where generated assembly.Please help me.

1 0

help me
by Leonard Euler 12 Nov '12

12 Nov '12

I am a novice programmer and at work gave me the following problem: find a place in the code where interpretr decides that should work DFG-JIT. I searched this part of code 2 weeks and I didn't find anything.Please help me.

1 0

CharCodeAtIntrinsic
by wingoog moon 07 Oct '12

07 Oct '12

Hi all. Tring to understand CharCodeAtIntrinsic in DFG. As I understand it has to call stringProtoFuncCharCodeAt(ExecState*) function, but in produced assembly thera is no call instruction under StringCharCodeAt Node Here is the test script var b=0; function f() { var str="hello"; var a=str.charCodeAt(0); b=b+a; } var i=0; for(i=0;i<2500;i++) { f(); } print(b); And the part of procused assembly. .............................................. 24: < 1:5> GetIndexedPropertyStorage(@4<String>, Storage|PureInt|CanExit, String, bc#20) 0x7fc503077871: mov 0x10(%rax), %rcx 0x7fc503077875: test %ecx, %ecx 0x7fc503077877: jz 0x7fc5030779c0 0x7fc50307787d: mov 0x8(%rcx), %rcx 15: < 1:5> StringCharCodeAt(@4<String>, @13<Int32>, @24, Int32|CanExit, String, bc#20) 0x7fc503077881: xor %ebx, %ebx 0x7fc503077883: cmp 0xc(%rax), %ebx 0x7fc503077886: jae 0x7fc5030779e1 0x7fc50307788c: mov 0x10(%rax), %rdi 0x7fc503077890: test $0x40, 0x18(%rdi) 0x7fc503077897: jz 0x7fc5030778a6 0x7fc50307789d: movzx (%rcx,%rbx), %edi 0x7fc5030778a1: jmp 0x7fc5030778aa 0x7fc5030778a6: movzx (%rcx,%rbx,2), %edi 0x7fc5030778aa: mov $0xffffffff, %r11 0x7fc5030778b4: cmp %r11, %rdi 0x7fc5030778b7: jbe 0x7fc5030778be 0x7fc5030778bd: int3 16: skipped < 0:-> SetLocal(@15<Int32>, <empty>, r1(H), bc#20) 17: < 1:4> GetGlobalVar(JS, global4(0x7fc5478bfa00), bc#29) predicting Int 0x7fc5030778be: mov $0x7fc5478bfa00, %rsi 0x7fc5030778c8: mov (%rsi), %rsi .............................................. As I understand from assembly, StringCharCodeAt only loads "h" to edi. So the question is how StringCharCodeAt calls stringProtoFuncCharCodeAt or where the actual converting from char to unicode is done?

2 1

Re: [squirrelfish] [webkit-dev] [webkit-help] Optimize Property Access failed
by talking1239＠gmail.com 09 Aug '12

09 Aug '12

My webkkit version 60***** and many custom features are verified, so it is hard to update it. But after check the Changlog, i find that GC is related with JIT Infrastructure and ARCH code. -- BGs/Felix Shi At 2012-08-09 07:36:16,"Filip Pizlo" <fpizlo(a)apple.com> wrote: The existence of the enable flag you mention implies that you have an ancient version of WebKit. Please consider updating. -Filip On Aug 7, 2012, at 11:39 PM, talking1239(a)gmail.com wrote: Hi I enable ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS feature and find that it will crash when go back the home page after run follow test case, I think it is caused by the optimize propery access, so anyone know that it is caused by the arch related code or jit Infrastructure code? and if i disable ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS feature, it will run correctly. Any help explaining this would be much appreciated! test case: var Origin = new Object(); function Init() { Origin.V = [150] } for ( var i = 20; i <= 160; i *= 2 ) { //Init(i); } Init(); Init(); Init(); Origin = null; Callstack: JAVASCRIPTCORE!const JSC::JSArray::`vftable' + 2 bytes JAVASCRIPTCORE!JSC::Heap::sweep() line 1104 + 14 bytes JAVASCRIPTCORE!JSC::Heap::collectAllGarbage() line 1306 WEBKIT!WebCore::collect(void * 0x00000000) line 47 WEBKIT!WebCore::GCController::gcTimerFired(WebCore::Timer<WebCore::GCController> * 0x06a905a0 {m_object=??? m_function=??? }) line 70 WEBKIT!WebCore::Timer<WebCore::PageCache>::fired() line 98 + 20 bytes WEBKIT!WebCore::ThreadTimers::sharedTimerFiredInternal() line 115 WEBKIT!WebCore::ThreadTimers::sharedTimerFired() line 91 -- BGs/Felix Shi _______________________________________________ webkit-dev mailing list webkit-dev(a)lists.webkit.org http://lists.webkit.org/mailman/listinfo/webkit-dev

1 0