Revision: 24502
Author: [email protected]
Date: Thu Oct 9 17:06:17 2014 UTC
Log: MIPS: Fix uninitialized FixedArray potentially being left behind
by ElementsTransitionGenerator::GenerateDoubleToObject.
Port r24498 (eeef8c0)
BUG=chromium:421843
LOG=n
[email protected]
Review URL: https://codereview.chromium.org/645633002
https://code.google.com/p/v8/source/detail?r=24502
Modified:
/branches/bleeding_edge/src/mips/codegen-mips.cc
/branches/bleeding_edge/src/mips64/codegen-mips64.cc
=======================================
--- /branches/bleeding_edge/src/mips/codegen-mips.cc Wed Sep 10 19:18:28
2014 UTC
+++ /branches/bleeding_edge/src/mips/codegen-mips.cc Thu Oct 9 17:06:17
2014 UTC
@@ -896,9 +896,23 @@
FixedDoubleArray::kHeaderSize - kHeapObjectTag
+ Register::kExponentOffset));
__ Addu(dst_elements, array, Operand(FixedArray::kHeaderSize));
- __ Addu(array, array, Operand(kHeapObjectTag));
__ sll(dst_end, dst_end, 1);
__ Addu(dst_end, dst_elements, dst_end);
+
+ // Allocating heap numbers in the loop below can fail and cause a jump to
+ // gc_required. We can't leave a partly initialized FixedArray behind,
+ // so pessimistically fill it with holes now.
+ Label initialization_loop, initialization_loop_entry;
+ __ LoadRoot(scratch, Heap::kTheHoleValueRootIndex);
+ __ Branch(&initialization_loop_entry);
+ __ bind(&initialization_loop);
+ __ sw(scratch, MemOperand(dst_elements));
+ __ Addu(dst_elements, dst_elements, Operand(kPointerSize));
+ __ bind(&initialization_loop_entry);
+ __ Branch(&initialization_loop, lt, dst_elements, Operand(dst_end));
+
+ __ Addu(dst_elements, array, Operand(FixedArray::kHeaderSize));
+ __ Addu(array, array, Operand(kHeapObjectTag));
__ LoadRoot(heap_number_map, Heap::kHeapNumberMapRootIndex);
// Using offsetted addresses.
// dst_elements: begin of destination FixedArray element fields, not
tagged
=======================================
--- /branches/bleeding_edge/src/mips64/codegen-mips64.cc Wed Sep 10
19:18:28 2014 UTC
+++ /branches/bleeding_edge/src/mips64/codegen-mips64.cc Thu Oct 9
17:06:17 2014 UTC
@@ -786,9 +786,23 @@
__ Daddu(src_elements, src_elements,
Operand(FixedDoubleArray::kHeaderSize - kHeapObjectTag + 4));
__ Daddu(dst_elements, array, Operand(FixedArray::kHeaderSize));
- __ Daddu(array, array, Operand(kHeapObjectTag));
__ SmiScale(dst_end, dst_end, kPointerSizeLog2);
__ Daddu(dst_end, dst_elements, dst_end);
+
+ // Allocating heap numbers in the loop below can fail and cause a jump to
+ // gc_required. We can't leave a partly initialized FixedArray behind,
+ // so pessimistically fill it with holes now.
+ Label initialization_loop, initialization_loop_entry;
+ __ LoadRoot(scratch, Heap::kTheHoleValueRootIndex);
+ __ Branch(&initialization_loop_entry);
+ __ bind(&initialization_loop);
+ __ sd(scratch, MemOperand(dst_elements));
+ __ Daddu(dst_elements, dst_elements, Operand(kPointerSize));
+ __ bind(&initialization_loop_entry);
+ __ Branch(&initialization_loop, lt, dst_elements, Operand(dst_end));
+
+ __ Daddu(dst_elements, array, Operand(FixedArray::kHeaderSize));
+ __ Daddu(array, array, Operand(kHeapObjectTag));
__ LoadRoot(heap_number_map, Heap::kHeapNumberMapRootIndex);
// Using offsetted addresses.
// dst_elements: begin of destination FixedArray element fields, not
tagged
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
