Changeset 195683 in webkit

Timestamp:

Jan 27, 2016 12:10:55 PM (8 years ago)

Author:

fpizlo@apple.com

Message:

Air::TmpWidth uses a stale pointer into its HashMap after it calls add()
​https://bugs.webkit.org/show_bug.cgi?id=153546

Reviewed by Saam Barati.

• b3/air/AirTmpWidth.cpp:

(JSC::B3::Air::TmpWidth::recompute):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• b3/air/AirTmpWidth.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-01-27  Filip Pizlo  <fpizlo@apple.com>
+
+        Air::TmpWidth uses a stale pointer into its HashMap after it calls add()
+        https://bugs.webkit.org/show_bug.cgi?id=153546
+
+        Reviewed by Saam Barati.
+
+        * b3/air/AirTmpWidth.cpp:
+        (JSC::B3::Air::TmpWidth::recompute):
+
 2016-01-27  Alexey Proskuryakov  <ap@apple.com>
 

trunk/Source/JavaScriptCore/b3/air/AirTmpWidth.cpp

@@ -91 +91 @@
             if (inst.opcode == Move && inst.args[1].isTmp()) {
                 if (inst.args[0].isTmp()) {
+                    // Make sure that both sides of the Move have a width already initialized. The
+                    // fixpoint below assumes that it never has to add things to the HashMap.
+                    m_width.add(inst.args[0].tmp(), Widths(Arg::GP));
+                    m_width.add(inst.args[1].tmp(), Widths(Arg::GP));
+                    
                     moves.append(&inst);
                     continue;
@@ -134 +139 @@
             ASSERT(move->args[0].isTmp());
             ASSERT(move->args[1].isTmp());
-            
-            Widths& srcWidths = m_width.add(move->args[0].tmp(), Widths(Arg::GP)).iterator->value;
-            Widths& dstWidths = m_width.add(move->args[1].tmp(), Widths(Arg::GP)).iterator->value;
+
+            // We already ensure that both tmps are added to the width map. That's important
+            // because you cannot add both tmps here while simultaneously getting a reference to
+            // their values, since the second add would invalidate the reference returned by the
+            // first one.
+            Widths& srcWidths = m_width.find(move->args[0].tmp())->value;
+            Widths& dstWidths = m_width.find(move->args[1].tmp())->value;
 
             // Legend: