Changeset 194711 in webkit

Timestamp:

Jan 7, 2016 12:21:10 PM (8 years ago)

Author:

mark.lam@apple.com

Message:

ARMv7 or32(TrustedImm32, AbsoluteAddress) may have a bug with its use of dataTempRegister.
​https://bugs.webkit.org/show_bug.cgi?id=152833

Reviewed by Michael Saboff.

Follow-up patch to fix illegal use of memoryTempRegister as the src for ARM64's
store32.

• assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::or32):
(JSC::MacroAssemblerARM64::store):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• assembler/MacroAssemblerARM64.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-01-07  Mark Lam  <mark.lam@apple.com>
+
+        ARMv7 or32(TrustedImm32, AbsoluteAddress) may have a bug with its use of dataTempRegister.
+        https://bugs.webkit.org/show_bug.cgi?id=152833
+
+        Reviewed by Michael Saboff.
+
+        Follow-up patch to fix illegal use of memoryTempRegister as the src for ARM64's
+        store32.
+
+        * assembler/MacroAssemblerARM64.h:
+        (JSC::MacroAssemblerARM64::or32):
+        (JSC::MacroAssemblerARM64::store):
+
 2016-01-07  Konstantin Tokarev  <annulen@yandex.ru>
 

trunk/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h

@@ -545 +545 @@
         } else {
             load32(address.m_ptr, getCachedMemoryTempRegisterIDAndInvalidate());
-            or32(imm, memoryTempRegister, memoryTempRegister);
-            store32(memoryTempRegister, address.m_ptr);
+            or32(imm, memoryTempRegister, getCachedDataTempRegisterIDAndInvalidate());
+            store32(dataTempRegister, address.m_ptr);
         }
     }
@@ -3039 +3039 @@
     ALWAYS_INLINE void store(RegisterID src, const void* address)
     {
+        ASSERT(src != memoryTempRegister);
         intptr_t currentRegisterContents;
         if (m_cachedMemoryTempRegister.value(currentRegisterContents)) {