Revision: 24629
Author: [email protected]
Date: Wed Oct 15 12:06:41 2014 UTC
Log: Fix out-of-bounds read in SourcePositionToScriptPosition with
--hydrogen-track-positions.
We were indexing into the list of inlined functions with inlining ID, which
is incorrect.
There can be multiple inlinining IDs corresponding to the same inlined
function, because inlining ID is inlining path sensitive unique id for an
inlining attempt.
Additionally allow HAbnormalExit to have unknown source position even if we
are tracking source positions. No code is generated from abnormal exits
anyways.
[email protected]
BUG=v8:3184
LOG=N
Review URL: https://codereview.chromium.org/653993005
https://code.google.com/p/v8/source/detail?r=24629
Modified:
/branches/bleeding_edge/src/hydrogen.cc
/branches/bleeding_edge/src/hydrogen.h
=======================================
--- /branches/bleeding_edge/src/hydrogen.cc Fri Oct 10 13:27:52 2014 UTC
+++ /branches/bleeding_edge/src/hydrogen.cc Wed Oct 15 12:06:41 2014 UTC
@@ -144,7 +144,7 @@
entry->set_position(position);
} else {
DCHECK(!FLAG_hydrogen_track_positions ||
- !graph()->info()->IsOptimizing());
+ !graph()->info()->IsOptimizing() || instr->IsAbnormalExit());
}
first_ = last_ = entry;
}
@@ -3446,8 +3446,9 @@
maximum_environment_size_(0),
no_side_effects_scope_count_(0),
disallow_adding_new_values_(false),
- next_inline_id_(0),
- inlined_functions_(5, info->zone()) {
+ inlined_functions_(FLAG_hydrogen_track_positions ? 5 : 0,
info->zone()),
+ inlining_id_to_function_id_(FLAG_hydrogen_track_positions ? 5 : 0,
+ info->zone()) {
if (info->IsStub()) {
CallInterfaceDescriptor descriptor =
info->code_stub()->GetCallInterfaceDescriptor();
@@ -3527,7 +3528,8 @@
}
}
- int inline_id = next_inline_id_++;
+ int inline_id = inlining_id_to_function_id_.length();
+ inlining_id_to_function_id_.Add(id, zone());
if (inline_id != 0) {
CodeTracer::Scope tracing_scope(isolate()->GetCodeTracer());
@@ -3546,8 +3548,8 @@
return pos.raw();
}
- return inlined_functions_[pos.inlining_id()].start_position() +
- pos.position();
+ const int id = inlining_id_to_function_id_[pos.inlining_id()];
+ return inlined_functions_[id].start_position() + pos.position();
}
=======================================
--- /branches/bleeding_edge/src/hydrogen.h Thu Oct 2 10:52:12 2014 UTC
+++ /branches/bleeding_edge/src/hydrogen.h Wed Oct 15 12:06:41 2014 UTC
@@ -524,8 +524,8 @@
int start_position_;
};
- int next_inline_id_;
ZoneList<InlinedFunctionInfo> inlined_functions_;
+ ZoneList<int> inlining_id_to_function_id_;
DISALLOW_COPY_AND_ASSIGN(HGraph);
};
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
