Reviewers: danno, Jakob, paul.l..., dusmil.imgtec, akos.palfi.imgtec,
gergely.kis.imgtec,
Description:
MIPS: Fix uninitialized FixedArray potentially being left behind by
ElementsTransitionGenerator::GenerateDoubleToObject.
Port r24498 (eeef8c0)
BUG=chromium:421843
LOG=n
Please review this at https://codereview.chromium.org/645633002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+30, -2 lines):
M src/mips/codegen-mips.cc
M src/mips64/codegen-mips64.cc
Index: src/mips/codegen-mips.cc
diff --git a/src/mips/codegen-mips.cc b/src/mips/codegen-mips.cc
index
0ecac19b49219ffa2b06d1604b04746fe2b14fe3..599aace2ee67a2879b39d62f9f3eee91f3e48c7b
100644
--- a/src/mips/codegen-mips.cc
+++ b/src/mips/codegen-mips.cc
@@ -896,9 +896,23 @@ void
ElementsTransitionGenerator::GenerateDoubleToObject(
FixedDoubleArray::kHeaderSize - kHeapObjectTag
+ Register::kExponentOffset));
__ Addu(dst_elements, array, Operand(FixedArray::kHeaderSize));
- __ Addu(array, array, Operand(kHeapObjectTag));
__ sll(dst_end, dst_end, 1);
__ Addu(dst_end, dst_elements, dst_end);
+
+ // Allocating heap numbers in the loop below can fail and cause a jump to
+ // gc_required. We can't leave a partly initialized FixedArray behind,
+ // so pessimistically fill it with holes now.
+ Label initialization_loop, initialization_loop_entry;
+ __ LoadRoot(scratch, Heap::kTheHoleValueRootIndex);
+ __ Branch(&initialization_loop_entry);
+ __ bind(&initialization_loop);
+ __ sw(scratch, MemOperand(dst_elements));
+ __ Addu(dst_elements, dst_elements, Operand(kPointerSize));
+ __ bind(&initialization_loop_entry);
+ __ Branch(&initialization_loop, lt, dst_elements, Operand(dst_end));
+
+ __ Addu(dst_elements, array, Operand(FixedArray::kHeaderSize));
+ __ Addu(array, array, Operand(kHeapObjectTag));
__ LoadRoot(heap_number_map, Heap::kHeapNumberMapRootIndex);
// Using offsetted addresses.
// dst_elements: begin of destination FixedArray element fields, not
tagged
Index: src/mips64/codegen-mips64.cc
diff --git a/src/mips64/codegen-mips64.cc b/src/mips64/codegen-mips64.cc
index
fb395f7561b7d8a3fee9ce6af94e290b9639edca..cffac91332e2014ea1450b17ae0e0c90ef371865
100644
--- a/src/mips64/codegen-mips64.cc
+++ b/src/mips64/codegen-mips64.cc
@@ -786,9 +786,23 @@ void
ElementsTransitionGenerator::GenerateDoubleToObject(
__ Daddu(src_elements, src_elements,
Operand(FixedDoubleArray::kHeaderSize - kHeapObjectTag + 4));
__ Daddu(dst_elements, array, Operand(FixedArray::kHeaderSize));
- __ Daddu(array, array, Operand(kHeapObjectTag));
__ SmiScale(dst_end, dst_end, kPointerSizeLog2);
__ Daddu(dst_end, dst_elements, dst_end);
+
+ // Allocating heap numbers in the loop below can fail and cause a jump to
+ // gc_required. We can't leave a partly initialized FixedArray behind,
+ // so pessimistically fill it with holes now.
+ Label initialization_loop, initialization_loop_entry;
+ __ LoadRoot(scratch, Heap::kTheHoleValueRootIndex);
+ __ Branch(&initialization_loop_entry);
+ __ bind(&initialization_loop);
+ __ sd(scratch, MemOperand(dst_elements));
+ __ Daddu(dst_elements, dst_elements, Operand(kPointerSize));
+ __ bind(&initialization_loop_entry);
+ __ Branch(&initialization_loop, lt, dst_elements, Operand(dst_end));
+
+ __ Daddu(dst_elements, array, Operand(FixedArray::kHeaderSize));
+ __ Daddu(array, array, Operand(kHeapObjectTag));
__ LoadRoot(heap_number_map, Heap::kHeapNumberMapRootIndex);
// Using offsetted addresses.
// dst_elements: begin of destination FixedArray element fields, not
tagged
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
