From d6ec64d163aee037b529d5a857a280b9eb249964 Mon Sep 17 00:00:00 2001
From: "Nicolas B. Pierron" <nicolas.b.pierron@mozilla.com>
Date: Tue, 18 Jul 2017 12:08:22 +0000
Subject: [PATCH] Bug 1364908 - Add MacroAssembler::branchToComputedAddress.
 r=jandem

---
 js/src/jit/MacroAssembler.h                       |  3 +++
 js/src/jit/arm/MacroAssembler-arm-inl.h           | 15 +++++++++++++++
 js/src/jit/arm64/MacroAssembler-arm64-inl.h       |  6 ++++++
 js/src/jit/x64/MacroAssembler-x64-inl.h           |  7 +++++++
 .../jit/x86-shared/CodeGenerator-x86-shared.cpp   |  4 ++--
 js/src/jit/x86/MacroAssembler-x86-inl.h           |  6 ++++++
 6 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/js/src/jit/MacroAssembler.h b/js/src/jit/MacroAssembler.h
index 8149e231b400..e9e8f7110c0d 100644
--- a/js/src/jit/MacroAssembler.h
+++ b/js/src/jit/MacroAssembler.h
@@ -1266,6 +1266,9 @@ class MacroAssembler : public MacroAssemblerSpecific
     inline void branchTestStringTruthy(bool truthy, const ValueOperand& value, Label* label)
         DEFINED_ON(arm, arm64, mips32, mips64, x86_shared);
 
+    // Create an unconditional branch to the address given as argument.
+    inline void branchToComputedAddress(const BaseIndex& address) PER_ARCH;
+
   private:
 
     // Implementation for branch* methods.
diff --git a/js/src/jit/arm/MacroAssembler-arm-inl.h b/js/src/jit/arm/MacroAssembler-arm-inl.h
index e77dc17b6253..aa7df8d95e0b 100644
--- a/js/src/jit/arm/MacroAssembler-arm-inl.h
+++ b/js/src/jit/arm/MacroAssembler-arm-inl.h
@@ -2057,6 +2057,21 @@ MacroAssembler::branchTestMagic(Condition cond, const Address& valaddr, JSWhyMag
     branch32(cond, ToPayload(valaddr), Imm32(why), label);
 }
 
+void
+MacroAssembler::branchToComputedAddress(const BaseIndex& addr)
+{
+    MOZ_ASSERT(addr.base == pc, "Unsupported jump from any other addresses.");
+    MOZ_ASSERT(addr.offset == 0, "NYI: offsets from pc should be shifted by the number of instructions.");
+
+    Register base = addr.base;
+    uint32_t scale = Imm32::ShiftOf(addr.scale).value;
+
+    ma_ldr(DTRAddr(base, DtrRegImmShift(addr.index, LSL, scale)), pc);
+    // When loading from pc, the pc is shifted to the next instruction, we
+    // add one extra instruction to accomodate for this shifted offset.
+    breakpoint();
+}
+
 // ========================================================================
 // Memory access primitives.
 void
diff --git a/js/src/jit/arm64/MacroAssembler-arm64-inl.h b/js/src/jit/arm64/MacroAssembler-arm64-inl.h
index 908fd60d92fa..8b0d8f477522 100644
--- a/js/src/jit/arm64/MacroAssembler-arm64-inl.h
+++ b/js/src/jit/arm64/MacroAssembler-arm64-inl.h
@@ -1656,6 +1656,12 @@ MacroAssembler::branchTestMagic(Condition cond, const Address& valaddr, JSWhyMag
     B(label, cond);
 }
 
+void
+MacroAssembler::branchToComputedAddress(const BaseIndex& addr)
+{
+    MOZ_CRASH("branchToComputedAddress");
+}
+
 // ========================================================================
 // Memory access primitives.
 void
diff --git a/js/src/jit/x64/MacroAssembler-x64-inl.h b/js/src/jit/x64/MacroAssembler-x64-inl.h
index 8c6e542ce7ca..adff1860729b 100644
--- a/js/src/jit/x64/MacroAssembler-x64-inl.h
+++ b/js/src/jit/x64/MacroAssembler-x64-inl.h
@@ -772,6 +772,13 @@ MacroAssembler::branchTestMagic(Condition cond, const Address& valaddr, JSWhyMag
     cmpPtr(valaddr, ImmWord(magic));
     j(cond, label);
 }
+
+void
+MacroAssembler::branchToComputedAddress(const BaseIndex& address)
+{
+    jmp(Operand(address));
+}
+
 // ========================================================================
 // Truncate floating point.
 
diff --git a/js/src/jit/x86-shared/CodeGenerator-x86-shared.cpp b/js/src/jit/x86-shared/CodeGenerator-x86-shared.cpp
index 10cf37e62ad5..4b6532f948d1 100644
--- a/js/src/jit/x86-shared/CodeGenerator-x86-shared.cpp
+++ b/js/src/jit/x86-shared/CodeGenerator-x86-shared.cpp
@@ -1871,10 +1871,10 @@ CodeGeneratorX86Shared::emitTableSwitchDispatch(MTableSwitch* mir, Register inde
 
     // Compute the position where a pointer to the right case stands.
     masm.mov(ool->jumpLabel()->patchAt(), base);
-    Operand pointer = Operand(base, index, ScalePointer);
+    BaseIndex pointer(base, index, ScalePointer);
 
     // Jump to the right case
-    masm.jmp(pointer);
+    masm.branchToComputedAddress(pointer);
 }
 
 void
diff --git a/js/src/jit/x86/MacroAssembler-x86-inl.h b/js/src/jit/x86/MacroAssembler-x86-inl.h
index d4c4ea3a9b35..2c3ae4688f8a 100644
--- a/js/src/jit/x86/MacroAssembler-x86-inl.h
+++ b/js/src/jit/x86/MacroAssembler-x86-inl.h
@@ -922,6 +922,12 @@ MacroAssembler::branchTestMagic(Condition cond, const Address& valaddr, JSWhyMag
     branch32(cond, ToPayload(valaddr), Imm32(why), label);
 }
 
+void
+MacroAssembler::branchToComputedAddress(const BaseIndex& addr)
+{
+    jmp(Operand(addr));
+}
+
 // ========================================================================
 // Truncate floating point.