[webkit-changes] [158057] trunk/Source/JavaScriptCore

Fri, 25 Oct 2013 15:00:34 -0700

Title: [158057] trunk/Source/_javascript_Core
Revision
158057
Author
[email protected]
Date
2013-10-25 15:01:35 -0700 (Fri, 25 Oct 2013)

Log Message

[Win] _javascript_ crash with DFG JIT enabled.
https://bugs.webkit.org/show_bug.cgi?id=121001

Patch by [email protected] <[email protected]> on 2013-10-25
Reviewed by Geoffrey Garen.

On windows, using register GPRInfo::regT0 as parameter to e.g. JIT::storeDouble(..., GPRInfo::regT0)),
results in a call to JIT::storeDouble(FPRegisterID src, const void* address),
where the address parameter gets the value of GPRInfo::regT0, which is 0 (eax on Windows).
This causes the register to be written to address 0, hence the crash.

* assembler/MacroAssemblerX86.h:
(JSC::MacroAssemblerX86::storeDouble): Assert if we try to generate code which writes to a null pointer.
* dfg/DFGOSRExitCompiler32_64.cpp:
(JSC::DFG::OSRExitCompiler::compileExit): Use address in regT0 as parameter.
* dfg/DFGThunks.cpp:
(JSC::DFG::osrExitGenerationThunkGenerator): Ditto.

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (158056 => 158057)


--- trunk/Source/_javascript_Core/ChangeLog	2013-10-25 22:01:17 UTC (rev 158056)
+++ trunk/Source/_javascript_Core/ChangeLog	2013-10-25 22:01:35 UTC (rev 158057)
@@ -1,3 +1,22 @@
+2013-10-25  [email protected]  <[email protected]>
+
+        [Win] _javascript_ crash with DFG JIT enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=121001
+
+        Reviewed by Geoffrey Garen.
+
+        On windows, using register GPRInfo::regT0 as parameter to e.g. JIT::storeDouble(..., GPRInfo::regT0)),
+        results in a call to JIT::storeDouble(FPRegisterID src, const void* address),
+        where the address parameter gets the value of GPRInfo::regT0, which is 0 (eax on Windows).
+        This causes the register to be written to address 0, hence the crash.
+  
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::storeDouble): Assert if we try to generate code which writes to a null pointer.
+        * dfg/DFGOSRExitCompiler32_64.cpp:
+        (JSC::DFG::OSRExitCompiler::compileExit): Use address in regT0 as parameter.
+        * dfg/DFGThunks.cpp:
+        (JSC::DFG::osrExitGenerationThunkGenerator): Ditto.
+
 2013-10-25  Oliver Hunt  <[email protected]>
 
         Fix a number of problems with destructuring of arguments

Modified: trunk/Source/_javascript_Core/assembler/MacroAssemblerX86.h (158056 => 158057)


--- trunk/Source/_javascript_Core/assembler/MacroAssemblerX86.h	2013-10-25 22:01:17 UTC (rev 158056)
+++ trunk/Source/_javascript_Core/assembler/MacroAssemblerX86.h	2013-10-25 22:01:35 UTC (rev 158057)
@@ -119,6 +119,7 @@
     void storeDouble(FPRegisterID src, const void* address)
     {
         ASSERT(isSSE2Present());
+        ASSERT(address);
         m_assembler.movsd_rm(src, address);
     }

Modified: trunk/Source/_javascript_Core/dfg/DFGOSRExitCompiler32_64.cpp (158056 => 158057)


--- trunk/Source/_javascript_Core/dfg/DFGOSRExitCompiler32_64.cpp	2013-10-25 22:01:17 UTC (rev 158056)
+++ trunk/Source/_javascript_Core/dfg/DFGOSRExitCompiler32_64.cpp	2013-10-25 22:01:35 UTC (rev 158057)
@@ -230,7 +230,7 @@
         switch (recovery.technique()) {
         case InFPR:
             m_jit.move(AssemblyHelpers::TrustedImmPtr(scratch + index), GPRInfo::regT0);
-            m_jit.storeDouble(recovery.fpr(), GPRInfo::regT0);
+            m_jit.storeDouble(recovery.fpr(), MacroAssembler::Address(GPRInfo::regT0));
             break;
             
         default:

Modified: trunk/Source/_javascript_Core/dfg/DFGThunks.cpp (158056 => 158057)


--- trunk/Source/_javascript_Core/dfg/DFGThunks.cpp	2013-10-25 22:01:17 UTC (rev 158056)
+++ trunk/Source/_javascript_Core/dfg/DFGThunks.cpp	2013-10-25 22:01:35 UTC (rev 158057)
@@ -53,12 +53,12 @@
     }
     for (unsigned i = 0; i < FPRInfo::numberOfRegisters; ++i) {
         jit.move(MacroAssembler::TrustedImmPtr(buffer + GPRInfo::numberOfRegisters + i), GPRInfo::regT0);
-        jit.storeDouble(FPRInfo::toRegister(i), GPRInfo::regT0);
+        jit.storeDouble(FPRInfo::toRegister(i), MacroAssembler::Address(GPRInfo::regT0));
     }
     
     // Tell GC mark phase how much of the scratch buffer is active during call.
     jit.move(MacroAssembler::TrustedImmPtr(scratchBuffer->activeLengthPtr()), GPRInfo::regT0);
-    jit.storePtr(MacroAssembler::TrustedImmPtr(scratchSize), GPRInfo::regT0);
+    jit.storePtr(MacroAssembler::TrustedImmPtr(scratchSize), MacroAssembler::Address(GPRInfo::regT0));
 
     // Set up one argument.
 #if CPU(X86)
@@ -70,11 +70,11 @@
     MacroAssembler::Call functionCall = jit.call();
 
     jit.move(MacroAssembler::TrustedImmPtr(scratchBuffer->activeLengthPtr()), GPRInfo::regT0);
-    jit.storePtr(MacroAssembler::TrustedImmPtr(0), GPRInfo::regT0);
+    jit.storePtr(MacroAssembler::TrustedImmPtr(0), MacroAssembler::Address(GPRInfo::regT0));
 
     for (unsigned i = 0; i < FPRInfo::numberOfRegisters; ++i) {
         jit.move(MacroAssembler::TrustedImmPtr(buffer + GPRInfo::numberOfRegisters + i), GPRInfo::regT0);
-        jit.loadDouble(GPRInfo::regT0, FPRInfo::toRegister(i));
+        jit.loadDouble(MacroAssembler::Address(GPRInfo::regT0), FPRInfo::toRegister(i));
     }
     for (unsigned i = 0; i < GPRInfo::numberOfRegisters; ++i) {
 #if USE(JSVALUE64)

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to