Revision: 24498
Author: [email protected]
Date: Thu Oct 9 14:12:05 2014 UTC
Log: Fix uninitialized FixedArray potentially being left behind by
ElementsTransitionGenerator::GenerateDoubleToObject
BUG=chromium:421843
LOG=n
[email protected]
Review URL: https://codereview.chromium.org/636313003
https://code.google.com/p/v8/source/detail?r=24498
Modified:
/branches/bleeding_edge/src/arm/codegen-arm.cc
/branches/bleeding_edge/src/arm64/codegen-arm64.cc
/branches/bleeding_edge/src/ia32/codegen-ia32.cc
/branches/bleeding_edge/src/runtime/runtime-test.cc
/branches/bleeding_edge/src/x64/codegen-x64.cc
=======================================
--- /branches/bleeding_edge/src/arm/codegen-arm.cc Wed Sep 10 12:38:12 2014
UTC
+++ /branches/bleeding_edge/src/arm/codegen-arm.cc Thu Oct 9 14:12:05 2014
UTC
@@ -604,8 +604,22 @@
__ add(src_elements, elements,
Operand(FixedDoubleArray::kHeaderSize - kHeapObjectTag + 4));
__ add(dst_elements, array, Operand(FixedArray::kHeaderSize));
- __ add(array, array, Operand(kHeapObjectTag));
__ add(dst_end, dst_elements, Operand(length, LSL, 1));
+
+ // Allocating heap numbers in the loop below can fail and cause a jump to
+ // gc_required. We can't leave a partly initialized FixedArray behind,
+ // so pessimistically fill it with holes now.
+ Label initialization_loop, initialization_loop_entry;
+ __ LoadRoot(scratch, Heap::kTheHoleValueRootIndex);
+ __ b(&initialization_loop_entry);
+ __ bind(&initialization_loop);
+ __ str(scratch, MemOperand(dst_elements, kPointerSize, PostIndex));
+ __ bind(&initialization_loop_entry);
+ __ cmp(dst_elements, dst_end);
+ __ b(lt, &initialization_loop);
+
+ __ add(dst_elements, array, Operand(FixedArray::kHeaderSize));
+ __ add(array, array, Operand(kHeapObjectTag));
__ LoadRoot(heap_number_map, Heap::kHeapNumberMapRootIndex);
// Using offsetted addresses in src_elements to fully take advantage of
// post-indexing.
=======================================
--- /branches/bleeding_edge/src/arm64/codegen-arm64.cc Wed Sep 10 12:38:12
2014 UTC
+++ /branches/bleeding_edge/src/arm64/codegen-arm64.cc Thu Oct 9 14:12:05
2014 UTC
@@ -290,15 +290,28 @@
Register src_elements = x10;
Register dst_elements = x11;
Register dst_end = x12;
+ Register the_hole = x14;
+ __ LoadRoot(the_hole, Heap::kTheHoleValueRootIndex);
__ Add(src_elements, elements,
FixedDoubleArray::kHeaderSize - kHeapObjectTag);
+ __ Add(dst_elements, array, FixedArray::kHeaderSize);
+ __ Add(dst_end, dst_elements, Operand(length, LSL, kPointerSizeLog2));
+
+ // Allocating heap numbers in the loop below can fail and cause a jump to
+ // gc_required. We can't leave a partly initialized FixedArray behind,
+ // so pessimistically fill it with holes now.
+ Label initialization_loop, initialization_loop_entry;
+ __ B(&initialization_loop_entry);
+ __ bind(&initialization_loop);
+ __ Str(the_hole, MemOperand(dst_elements, kPointerSize, PostIndex));
+ __ bind(&initialization_loop_entry);
+ __ Cmp(dst_elements, dst_end);
+ __ B(lt, &initialization_loop);
+
__ Add(dst_elements, array, FixedArray::kHeaderSize);
__ Add(array, array, kHeapObjectTag);
- __ Add(dst_end, dst_elements, Operand(length, LSL, kPointerSizeLog2));
- Register the_hole = x14;
Register heap_num_map = x15;
- __ LoadRoot(the_hole, Heap::kTheHoleValueRootIndex);
__ LoadRoot(heap_num_map, Heap::kHeapNumberMapRootIndex);
Label entry;
=======================================
--- /branches/bleeding_edge/src/ia32/codegen-ia32.cc Wed Sep 10 12:38:12
2014 UTC
+++ /branches/bleeding_edge/src/ia32/codegen-ia32.cc Thu Oct 9 14:12:05
2014 UTC
@@ -720,6 +720,19 @@
__ mov(FieldOperand(eax, FixedArray::kLengthOffset), ebx);
__ mov(edi, FieldOperand(edx, JSObject::kElementsOffset));
+ // Allocating heap numbers in the loop below can fail and cause a jump to
+ // gc_required. We can't leave a partly initialized FixedArray behind,
+ // so pessimistically fill it with holes now.
+ Label initialization_loop, initialization_loop_entry;
+ __ jmp(&initialization_loop_entry, Label::kNear);
+ __ bind(&initialization_loop);
+ __ mov(FieldOperand(eax, ebx, times_2, FixedArray::kHeaderSize),
+ masm->isolate()->factory()->the_hole_value());
+ __ bind(&initialization_loop_entry);
+ __ sub(ebx, Immediate(Smi::FromInt(1)));
+ __ j(not_sign, &initialization_loop);
+
+ __ mov(ebx, FieldOperand(edi, FixedDoubleArray::kLengthOffset));
__ jmp(&entry);
// ebx: target map
=======================================
--- /branches/bleeding_edge/src/runtime/runtime-test.cc Tue Sep 30 10:46:04
2014 UTC
+++ /branches/bleeding_edge/src/runtime/runtime-test.cc Thu Oct 9 14:12:05
2014 UTC
@@ -247,7 +247,9 @@
RUNTIME_FUNCTION(Runtime_SystemBreak) {
- SealHandleScope shs(isolate);
+ // The code below doesn't create handles, but when breaking here in GDB
+ // having a handle scope might be useful.
+ HandleScope scope(isolate);
DCHECK(args.length() == 0);
base::OS::DebugBreak();
return isolate->heap()->undefined_value();
=======================================
--- /branches/bleeding_edge/src/x64/codegen-x64.cc Wed Sep 10 12:38:12 2014
UTC
+++ /branches/bleeding_edge/src/x64/codegen-x64.cc Thu Oct 9 14:12:05 2014
UTC
@@ -397,6 +397,20 @@
__ LoadRoot(rdi, Heap::kTheHoleValueRootIndex);
// rsi: the-hole NaN
// rdi: pointer to the-hole
+
+ // Allocating heap numbers in the loop below can fail and cause a jump to
+ // gc_required. We can't leave a partly initialized FixedArray behind,
+ // so pessimistically fill it with holes now.
+ Label initialization_loop, initialization_loop_entry;
+ __ jmp(&initialization_loop_entry, Label::kNear);
+ __ bind(&initialization_loop);
+ __ movp(FieldOperand(r11, r9, times_pointer_size,
FixedArray::kHeaderSize),
+ rdi);
+ __ bind(&initialization_loop_entry);
+ __ decp(r9);
+ __ j(not_sign, &initialization_loop);
+
+ __ SmiToInteger32(r9, FieldOperand(r8, FixedDoubleArray::kLengthOffset));
__ jmp(&entry);
// Call into runtime if GC is required.
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
