Changeset 273104 in webkit

Timestamp:

Feb 18, 2021, 3:20:43 PM (6 years ago)

Author:

commit-queue@webkit.org

Message:

[JSC] Fix segfaults on 32-bit big endian systems
​https://bugs.webkit.org/show_bug.cgi?id=221710

Patch by Daniel Kolesa <Daniel Kolesa> on 2021-02-18
Reviewed by Yusuke Suzuki.

In these cases, we are loading values from memory into registers.
Seemingly, these values are present at an offset on 32-bit big
endian targets; therefore, add PayloadOffset, which is 4 on BE
and 0 on LE (same behavior as right now) and is already present
in other similar accesses in the file.

• llint/LowLevelInterpreter32_64.asm:

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• llint/LowLevelInterpreter32_64.asm (modified) (4 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-02-18  Daniel Kolesa  <dkolesa@igalia.com>
+
+        [JSC] Fix segfaults on 32-bit big endian systems
+        https://bugs.webkit.org/show_bug.cgi?id=221710
+
+        Reviewed by Yusuke Suzuki.
+
+        In these cases, we are loading values from memory into registers.
+        Seemingly, these values are present at an offset on 32-bit big
+        endian targets; therefore, add PayloadOffset, which is 4 on BE
+        and 0 on LE (same behavior as right now) and is already present
+        in other similar accesses in the file.
+
+        * llint/LowLevelInterpreter32_64.asm:
+
 2021-02-18  Michael Saboff  <msaboff@apple.com>
 

trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm

@@ -1580 +1580 @@
     assert(macro (ok) btpnz t3, ok end)
 
-    loadp Structure::m_prototype[t2], t2
+    loadp Structure::m_prototype + PayloadOffset[t2], t2
     btpz t2, .opPutByIdTransitionChainDone
 .opPutByIdTransitionChainLoop:
@@ -1586 +1586 @@
     bineq t1, JSCell::m_structureID[t2], .opPutByIdSlow
     addp 4, t3
-    loadp Structure::m_prototype[t1], t2
+    loadp Structure::m_prototype + PayloadOffset[t1], t2
     btpnz t2, .opPutByIdTransitionChainLoop
 
@@ -2252 +2252 @@
 
 op(llint_throw_from_slow_path_trampoline, macro()
-    loadp Callee[cfr], t1
+    loadp Callee + PayloadOffset[cfr], t1
     convertCalleeToVM(t1)
     copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(t1, t2)
@@ -2261 +2261 @@
     # the throw target is not necessarily interpreted code, we come to here.
     # This essentially emulates the JIT's throwing protocol.
-    loadp Callee[cfr], t1
+    loadp Callee + PayloadOffset[cfr], t1
     convertCalleeToVM(t1)
     jmp VM::targetMachinePCForThrow[t1]