Changeset 271240 in webkit

Timestamp:

Jan 7, 2021, 9:33:24 AM (6 years ago)

Author:

mark.lam@apple.com

Message:

The scratch register should be different from the target register when calling validateUntaggedPtr.
​https://bugs.webkit.org/show_bug.cgi?id=220397
rdar://72771069

Reviewed by Yusuke Suzuki.

• assembler/MacroAssemblerARM64E.h:

(JSC::MacroAssemblerARM64E::validateUntaggedPtr):

• Added an ASSERT to enforce this invariant.
• jit/ThunkGenerators.cpp:

(JSC::emitPointerValidation):

• emitPointerValidation() was reusing the target register as the scratch register. This is a hold over from the previous way of doing the validation (which had a bug). With the validation bug fixed, this register reuse is no longer allowed.

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• assembler/MacroAssemblerARM64E.h (modified) (1 diff)
• jit/ThunkGenerators.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-01-07  Mark Lam  <mark.lam@apple.com>
+
+        The scratch register should be different from the target register when calling validateUntaggedPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=220397
+        rdar://72771069
+
+        Reviewed by Yusuke Suzuki.
+
+        * assembler/MacroAssemblerARM64E.h:
+        (JSC::MacroAssemblerARM64E::validateUntaggedPtr):
+        - Added an ASSERT to enforce this invariant.
+        * jit/ThunkGenerators.cpp:
+        (JSC::emitPointerValidation):
+        - emitPointerValidation() was reusing the target register as the scratch register.
+          This is a hold over from the previous way of doing the validation (which had a
+          bug).  With the validation bug fixed, this register reuse is no longer allowed.
+
 2021-01-07  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/assembler/MacroAssemblerARM64E.h

@@ -88 +88 @@
 
         DisallowMacroScratchRegisterUsage disallowScope(*this);
+        ASSERT(target != scratch);
         rshift64(target, TrustedImm32(8), scratch);
         and64(TrustedImm64(0xff000000000000), scratch, scratch);

trunk/Source/JavaScriptCore/jit/ThunkGenerators.cpp

@@ -52 +52 @@
         jit.pushToSave(pointerGPR);
         jit.untagPtr(tag, pointerGPR);
-        jit.validateUntaggedPtr(pointerGPR, pointerGPR);
+        jit.validateUntaggedPtr(pointerGPR);
         jit.popToRestore(pointerGPR);
     }