[webkit-dev] want to port JIT to MIPS - cti_op_mod(STUB_ARGS) seg fault

x yz lastguy at yahoo.com
Wed Apr 22 11:58:01 PDT 2009

The cause details are below:
1. original C funtion:
JSValueEncodedAsPointer* JITStubs::cti_op_mod(STUB_ARGS)
    BEGIN_STUB_FUNCTION();   //causes seg fault

    JSValuePtr dividendValue = ARG_src1;
    JSValuePtr divisorValue = ARG_src2;

    CallFrame* callFrame = ARG_callFrame;
    double d = dividendValue.toNumber(callFrame);
    JSValuePtr result = jsNumber(ARG_globalData, fmod(d, divisorValue.toNumber(callFrame)));
    return JSValuePtr::encode(result);
2. On X86:
Dump of assembler code for function _ZN3JSC8JITStubs10cti_op_modEPvz:
0x08141b12 <_ZN3JSC8JITStubs10cti_op_modEPvz+0>:	push   %ebp
0x08141b13 <_ZN3JSC8JITStubs10cti_op_modEPvz+1>:	mov    %esp,%ebp
0x08141b15 <_ZN3JSC8JITStubs10cti_op_modEPvz+3>:	push   %esi
0x08141b16 <_ZN3JSC8JITStubs10cti_op_modEPvz+4>:	push   %ebx
0x08141b17 <_ZN3JSC8JITStubs10cti_op_modEPvz+5>:	sub    $0x70,%esp
0x08141b1a <_ZN3JSC8JITStubs10cti_op_modEPvz+8>:	call   0x80577bc <__i686.get_pc_thunk.bx>   //this system call is not exist in MIPS compiled code
0x08141b1f <_ZN3JSC8JITStubs10cti_op_modEPvz+13>:	add    $0xee049,%ebx
0x08141b25 <_ZN3JSC8JITStubs10cti_op_modEPvz+19>:	lea    0xc(%ebp),%eax		//1677	    BEGIN_STUB_FUNCTION();
0x08141b28 <_ZN3JSC8JITStubs10cti_op_modEPvz+22>:	mov    %eax,-0x1c(%ebp)
0x08141b2b <_ZN3JSC8JITStubs10cti_op_modEPvz+25>:	mov    -0x1c(%ebp),%eax
0x08141b2e <_ZN3JSC8JITStubs10cti_op_modEPvz+28>:	sub    $0x8,%eax
0x08141b31 <_ZN3JSC8JITStubs10cti_op_modEPvz+31>:	mov    %eax,0x4(%esp)
0x08141b35 <_ZN3JSC8JITStubs10cti_op_modEPvz+35>:	lea    -0x24(%ebp),%eax
0x08141b38 <_ZN3JSC8JITStubs10cti_op_modEPvz+38>:	mov    %eax,(%esp)
0x08141b3b <_ZN3JSC8JITStubs10cti_op_modEPvz+41>:	call   0x8148e76 <StackHack>	//242	    ALWAYS_INLINE StackHack(void** location), MIPS disasm has no symbols at all
3. On MIPS
Dump of assembler code for function _ZN3JSC8JITStubs10cti_op_modEPvz:
0x006abdb8 <_ZN3JSC8JITStubs10cti_op_modEPvz+0>:	lui	gp,0xf96        //this segment used on other routines and works
0x006abdbc <_ZN3JSC8JITStubs10cti_op_modEPvz+4>:	addiu	gp,gp,6776
0x006abdc0 <_ZN3JSC8JITStubs10cti_op_modEPvz+8>:	addu	gp,gp,t9
0x006abdc4 <_ZN3JSC8JITStubs10cti_op_modEPvz+12>:	addiu	sp,sp,-88
0x006abdc8 <_ZN3JSC8JITStubs10cti_op_modEPvz+16>:	sw	ra,80(sp)
0x006abdcc <_ZN3JSC8JITStubs10cti_op_modEPvz+20>:	sw	s8,76(sp)
0x006abdd0 <_ZN3JSC8JITStubs10cti_op_modEPvz+24>:	sw	s0,72(sp)
0x006abdd4 <_ZN3JSC8JITStubs10cti_op_modEPvz+28>:	move	s8,sp
0x006abdd8 <_ZN3JSC8JITStubs10cti_op_modEPvz+32>:	sw	gp,16(sp)
0x006abddc <_ZN3JSC8JITStubs10cti_op_modEPvz+36>:	sw	a1,92(s8)
0x006abde0 <_ZN3JSC8JITStubs10cti_op_modEPvz+40>:	sw	a2,96(s8)
0x006abde4 <_ZN3JSC8JITStubs10cti_op_modEPvz+44>:	sw	a3,100(s8)
0x006abde8 <_ZN3JSC8JITStubs10cti_op_modEPvz+48>:	sw	a0,88(s8)
0x006abdec <_ZN3JSC8JITStubs10cti_op_modEPvz+52>:	addiu	v0,s8,92
0x006abdf0 <_ZN3JSC8JITStubs10cti_op_modEPvz+56>:	sw	v0,24(s8)
0x006abdf4 <_ZN3JSC8JITStubs10cti_op_modEPvz+60>:	addiu	v1,s8,32
0x006abdf8 <_ZN3JSC8JITStubs10cti_op_modEPvz+64>:	lw	v0,24(s8)
0x006abdfc <_ZN3JSC8JITStubs10cti_op_modEPvz+68>:	addiu	v0,v0,-8
0x006abe00 <_ZN3JSC8JITStubs10cti_op_modEPvz+72>:	move	a0,v1
0x006abe04 <_ZN3JSC8JITStubs10cti_op_modEPvz+76>:	move	a1,v0
0x006abe08 <_ZN3JSC8JITStubs10cti_op_modEPvz+80>:	lw	t9,-19028(gp)     //seg fault here, -19028(gp) not accesible
0x006abe0c <_ZN3JSC8JITStubs10cti_op_modEPvz+84>:	jalr	t9
... no label in MIPS. <StackHack> label shown on X86 but on mips are all xxx(gp), may be compiler/gdb not as good as X86 version?

thanks for look at it,

--- On Wed, 4/22/09, x yz <lastguy at yahoo.com> wrote:

> From: x yz <lastguy at yahoo.com>
> Subject: Re: [webkit-dev] want to port JIT to MIPS - cti_op_mod(STUB_ARGS) seg fault
> To: "WebKit Development" <webkit-dev at lists.webkit.org>, "Gavin Barraclough" <barraclough at apple.com>
> Date: Wednesday, April 22, 2009, 8:31 AM
> I use MIPS32EL, VA_LIST call, MIPS pushes function argument
> from left to right. I wrote a simple VA_LIST test it works
> on my box.
> BEGIN_STUB_FUNCTION() cause seg fault due to MIPS uses gp
> reg to read sth.
> I treied to rewrite the code like that:
> JSObject* JITStubs::cti_op_new_func_exp(STUB_ARGS)
> {
>     va_list vl_args; 
>     va_start(vl_args, args);
>     StackHack stackHack(&STUB_RETURN_ADDRESS_SLOT);
>     JSValuePtr dividendValue = va_arg(vl_args, JSC::JSCell*
> );
>     JSValuePtr divisorValue = va_arg(vl_args, JSC::JSCell*
> );
> ...
> }
> Still fail in stackHack(), if I comment out stackHack()
> then fails at va_arg.
> gp is a global register for common/public variables, the
> same usage before I call cti_op_mod() works fine.
> I also tried not use VA_LIST but REGISTER calling
> convention, still fail:
> (gdb) x/2i $at
> 0x6ab500
> <_ZN3JSC8JITStubs10cti_op_modEPPv>:	lui	gp,0xf96
> 0x6ab504
> <_ZN3JSC8JITStubs10cti_op_modEPPv+4>:	addiu	gp,gp,9008
> (gdb) x/20i $at
> 0x6ab500
> <_ZN3JSC8JITStubs10cti_op_modEPPv>:	lui	gp,0xf96
> 0x6ab504
> <_ZN3JSC8JITStubs10cti_op_modEPPv+4>:	addiu	gp,gp,9008
> 0x6ab508
> <_ZN3JSC8JITStubs10cti_op_modEPPv+8>:	addu	gp,gp,t9
> 0x6ab50c
> <_ZN3JSC8JITStubs10cti_op_modEPPv+12>:	addiu	sp,sp,-80
> 0x6ab510
> <_ZN3JSC8JITStubs10cti_op_modEPPv+16>:	sw	ra,72(sp)
> 0x6ab514
> <_ZN3JSC8JITStubs10cti_op_modEPPv+20>:	sw	s8,68(sp)
> 0x6ab518
> <_ZN3JSC8JITStubs10cti_op_modEPPv+24>:	sw	s0,64(sp)
> 0x6ab51c
> <_ZN3JSC8JITStubs10cti_op_modEPPv+28>:	move	s8,sp
> 0x6ab520
> <_ZN3JSC8JITStubs10cti_op_modEPPv+32>:	sw	gp,16(sp)
> 0x6ab524
> <_ZN3JSC8JITStubs10cti_op_modEPPv+36>:	sw	a0,80(s8)
> 0x6ab528
> <_ZN3JSC8JITStubs10cti_op_modEPPv+40>:	lw	v0,80(s8)
> 0x6ab52c
> <_ZN3JSC8JITStubs10cti_op_modEPPv+44>:	addiu	v0,v0,-4
> 0x6ab530
> <_ZN3JSC8JITStubs10cti_op_modEPPv+48>:	addiu	a0,s8,24
> 0x6ab534
> <_ZN3JSC8JITStubs10cti_op_modEPPv+52>:	move	a1,v0
> 0x6ab538
> <_ZN3JSC8JITStubs10cti_op_modEPPv+56>:	lw	t9,-19012(gp)
> 0x6ab53c
> <_ZN3JSC8JITStubs10cti_op_modEPPv+60>:	jalr	t9
> 0x6ab540 <_ZN3JSC8JITStubs10cti_op_modEPPv+64>:	nop
> 0x6ab544
> <_ZN3JSC8JITStubs10cti_op_modEPPv+68>:	lw	gp,16(s8)
> 0x6ab548
> <_ZN3JSC8JITStubs10cti_op_modEPPv+72>:	addiu	v0,s8,32
> 0x6ab54c
> <_ZN3JSC8JITStubs10cti_op_modEPPv+76>:	lw	v1,80(s8)
> (gdb) stepi 14
> Program received signal SIGSEGV, Segmentation fault.
> 0x006ab538 in JSC::JITStubs::cti_op_mod (args=0x2aac9500)
> at
> /home/jdai/depot/mp/mediabase/head/libs/webkit-1.1.1/JavaScriptCore/jit/JITStubs.cpp:1685
> another question is that there is no matched va_end() and
> it is a bug.
> thanks a lot for help,
> joe


More information about the webkit-dev mailing list