Revision: 16423
Author: [email protected]
Date: Thu Aug 29 12:09:31 2013 UTC
Log: Merged r16224 into 3.19 branch.
Fix invalid out-of-bounds store in MacroAssembler::Allocate.
BUG=chromium:263515
[email protected]
Review URL: https://codereview.chromium.org/23474012
http://code.google.com/p/v8/source/detail?r=16423
Modified:
/branches/3.19/src/arm/macro-assembler-arm.cc
/branches/3.19/src/ia32/macro-assembler-ia32.cc
/branches/3.19/src/version.cc
/branches/3.19/src/x64/macro-assembler-x64.cc
=======================================
--- /branches/3.19/src/arm/macro-assembler-arm.cc Tue Jun 18 11:54:54 2013
UTC
+++ /branches/3.19/src/arm/macro-assembler-arm.cc Thu Aug 29 12:09:31 2013
UTC
@@ -1692,12 +1692,16 @@
if ((flags & DOUBLE_ALIGNMENT) != 0) {
// Align the next allocation. Storing the filler map without checking
top is
- // always safe because the limit of the heap is always aligned.
+ // safe in new-space because the limit of the heap is aligned there.
ASSERT((flags & PRETENURE_OLD_POINTER_SPACE) == 0);
ASSERT(kPointerAlignment * 2 == kDoubleAlignment);
and_(scratch2, result, Operand(kDoubleAlignmentMask), SetCC);
Label aligned;
b(eq, &aligned);
+ if ((flags & PRETENURE_OLD_DATA_SPACE) != 0) {
+ cmp(result, Operand(ip));
+ b(hs, gc_required);
+ }
mov(scratch2, Operand(isolate()->factory()->one_pointer_filler_map()));
str(scratch2, MemOperand(result, kDoubleSize / 2, PostIndex));
bind(&aligned);
@@ -1790,12 +1794,16 @@
if ((flags & DOUBLE_ALIGNMENT) != 0) {
// Align the next allocation. Storing the filler map without checking
top is
- // always safe because the limit of the heap is always aligned.
+ // safe in new-space because the limit of the heap is aligned there.
ASSERT((flags & PRETENURE_OLD_POINTER_SPACE) == 0);
ASSERT(kPointerAlignment * 2 == kDoubleAlignment);
and_(scratch2, result, Operand(kDoubleAlignmentMask), SetCC);
Label aligned;
b(eq, &aligned);
+ if ((flags & PRETENURE_OLD_DATA_SPACE) != 0) {
+ cmp(result, Operand(ip));
+ b(hs, gc_required);
+ }
mov(scratch2, Operand(isolate()->factory()->one_pointer_filler_map()));
str(scratch2, MemOperand(result, kDoubleSize / 2, PostIndex));
bind(&aligned);
=======================================
--- /branches/3.19/src/ia32/macro-assembler-ia32.cc Tue Jun 18 11:54:54
2013 UTC
+++ /branches/3.19/src/ia32/macro-assembler-ia32.cc Thu Aug 29 12:09:31
2013 UTC
@@ -1265,26 +1265,29 @@
// Load address of new object into result.
LoadAllocationTopHelper(result, scratch, flags);
+ ExternalReference allocation_limit =
+ AllocationUtils::GetAllocationLimitReference(isolate(), flags);
+
// Align the next allocation. Storing the filler map without checking
top is
- // always safe because the limit of the heap is always aligned.
+ // safe in new-space because the limit of the heap is aligned there.
if ((flags & DOUBLE_ALIGNMENT) != 0) {
ASSERT((flags & PRETENURE_OLD_POINTER_SPACE) == 0);
ASSERT(kPointerAlignment * 2 == kDoubleAlignment);
Label aligned;
test(result, Immediate(kDoubleAlignmentMask));
j(zero, &aligned, Label::kNear);
+ if ((flags & PRETENURE_OLD_DATA_SPACE) != 0) {
+ cmp(result, Operand::StaticVariable(allocation_limit));
+ j(above_equal, gc_required);
+ }
mov(Operand(result, 0),
Immediate(isolate()->factory()->one_pointer_filler_map()));
add(result, Immediate(kDoubleSize / 2));
bind(&aligned);
}
+ // Calculate new top and bail out if space is exhausted.
Register top_reg = result_end.is_valid() ? result_end : result;
-
- // Calculate new top and bail out if space is exhausted.
- ExternalReference allocation_limit =
- AllocationUtils::GetAllocationLimitReference(isolate(), flags);
-
if (!top_reg.is(result)) {
mov(top_reg, result);
}
@@ -1339,14 +1342,21 @@
// Load address of new object into result.
LoadAllocationTopHelper(result, scratch, flags);
+ ExternalReference allocation_limit =
+ AllocationUtils::GetAllocationLimitReference(isolate(), flags);
+
// Align the next allocation. Storing the filler map without checking
top is
- // always safe because the limit of the heap is always aligned.
+ // safe in new-space because the limit of the heap is aligned there.
if ((flags & DOUBLE_ALIGNMENT) != 0) {
ASSERT((flags & PRETENURE_OLD_POINTER_SPACE) == 0);
ASSERT(kPointerAlignment * 2 == kDoubleAlignment);
Label aligned;
test(result, Immediate(kDoubleAlignmentMask));
j(zero, &aligned, Label::kNear);
+ if ((flags & PRETENURE_OLD_DATA_SPACE) != 0) {
+ cmp(result, Operand::StaticVariable(allocation_limit));
+ j(above_equal, gc_required);
+ }
mov(Operand(result, 0),
Immediate(isolate()->factory()->one_pointer_filler_map()));
add(result, Immediate(kDoubleSize / 2));
@@ -1354,9 +1364,6 @@
}
// Calculate new top and bail out if space is exhausted.
- ExternalReference allocation_limit =
- AllocationUtils::GetAllocationLimitReference(isolate(), flags);
-
// We assume that element_count*element_size + header_size does not
// overflow.
if (element_count_type == REGISTER_VALUE_IS_SMI) {
@@ -1410,14 +1417,21 @@
// Load address of new object into result.
LoadAllocationTopHelper(result, scratch, flags);
+ ExternalReference allocation_limit =
+ AllocationUtils::GetAllocationLimitReference(isolate(), flags);
+
// Align the next allocation. Storing the filler map without checking
top is
- // always safe because the limit of the heap is always aligned.
+ // safe in new-space because the limit of the heap is aligned there.
if ((flags & DOUBLE_ALIGNMENT) != 0) {
ASSERT((flags & PRETENURE_OLD_POINTER_SPACE) == 0);
ASSERT(kPointerAlignment * 2 == kDoubleAlignment);
Label aligned;
test(result, Immediate(kDoubleAlignmentMask));
j(zero, &aligned, Label::kNear);
+ if ((flags & PRETENURE_OLD_DATA_SPACE) != 0) {
+ cmp(result, Operand::StaticVariable(allocation_limit));
+ j(above_equal, gc_required);
+ }
mov(Operand(result, 0),
Immediate(isolate()->factory()->one_pointer_filler_map()));
add(result, Immediate(kDoubleSize / 2));
@@ -1425,9 +1439,6 @@
}
// Calculate new top and bail out if space is exhausted.
- ExternalReference allocation_limit =
- AllocationUtils::GetAllocationLimitReference(isolate(), flags);
-
if (!object_size.is(result_end)) {
mov(result_end, object_size);
}
=======================================
--- /branches/3.19/src/version.cc Mon Aug 19 11:18:02 2013 UTC
+++ /branches/3.19/src/version.cc Thu Aug 29 12:09:31 2013 UTC
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 19
#define BUILD_NUMBER 18
-#define PATCH_LEVEL 20
+#define PATCH_LEVEL 21
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
=======================================
--- /branches/3.19/src/x64/macro-assembler-x64.cc Tue Jun 18 11:54:54 2013
UTC
+++ /branches/3.19/src/x64/macro-assembler-x64.cc Thu Aug 29 12:09:31 2013
UTC
@@ -3821,7 +3821,7 @@
LoadAllocationTopHelper(result, scratch, flags);
// Align the next allocation. Storing the filler map without checking
top is
- // always safe because the limit of the heap is always aligned.
+ // safe in new-space because the limit of the heap is aligned there.
if (((flags & DOUBLE_ALIGNMENT) != 0) && FLAG_debug_code) {
testq(result, Immediate(kDoubleAlignmentMask));
Check(zero, "Allocation is not double aligned");
@@ -3888,7 +3888,7 @@
LoadAllocationTopHelper(result, scratch, flags);
// Align the next allocation. Storing the filler map without checking
top is
- // always safe because the limit of the heap is always aligned.
+ // safe in new-space because the limit of the heap is aligned there.
if (((flags & DOUBLE_ALIGNMENT) != 0) && FLAG_debug_code) {
testq(result, Immediate(kDoubleAlignmentMask));
Check(zero, "Allocation is not double aligned");
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
