Changeset 90731 in webkit

Timestamp:

Jul 11, 2011 3:31:20 AM (13 years ago)

Author:

loki@webkit.org

Message:

Signed arithmetic bug in dataTransfer32.
​https://bugs.webkit.org/show_bug.cgi?id=64257

Reviewed by Zoltan Herczeg.

An arithmetic bug is fixed. If the offset of dataTransfer is half of the
addressable memory space on a 32-bit machine (-2147483648 = 0x80000000)
a load instruction is emitted with a wrong zero offset.

Inspired by Jacob Bramley's patch from JaegerMonkey.

• assembler/ARMAssembler.cpp:

(JSC::ARMAssembler::dataTransfer32):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• assembler/ARMAssembler.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-07-11  Gabor Loki  <loki@webkit.org>
+
+        Signed arithmetic bug in dataTransfer32.
+        https://bugs.webkit.org/show_bug.cgi?id=64257
+
+        Reviewed by Zoltan Herczeg.
+
+        An arithmetic bug is fixed. If the offset of dataTransfer is half of the
+        addressable memory space on a 32-bit machine (-2147483648 = 0x80000000)
+        a load instruction is emitted with a wrong zero offset.
+
+        Inspired by Jacob Bramley's patch from JaegerMonkey.
+
+        * assembler/ARMAssembler.cpp:
+        (JSC::ARMAssembler::dataTransfer32):
+
 2011-07-09  Thouraya Andolsi  <thouraya.andolsi@st.com>
 

trunk/Source/JavaScriptCore/assembler/ARMAssembler.cpp

@@ -277 +277 @@
         }
     } else {
-        offset = -offset;
-        if (offset <= 0xfff)
-            dtr_d(isLoad, srcDst, base, offset | transferFlag);
-        else if (offset <= 0xfffff) {
-            sub_r(ARMRegisters::S0, base, OP2_IMM | (offset >> 12) | (10 << 8));
-            dtr_d(isLoad, srcDst, ARMRegisters::S0, (offset & 0xfff) | transferFlag);
+        if (offset >= -0xfff)
+            dtr_d(isLoad, srcDst, base, -offset | transferFlag);
+        else if (offset >= -0xfffff) {
+            sub_r(ARMRegisters::S0, base, OP2_IMM | (-offset >> 12) | (10 << 8));
+            dtr_d(isLoad, srcDst, ARMRegisters::S0, (-offset & 0xfff) | transferFlag);
         } else {
             moveImm(offset, ARMRegisters::S0);
-            dtr_dr(isLoad, srcDst, base, ARMRegisters::S0 | transferFlag);
+            dtr_ur(isLoad, srcDst, base, ARMRegisters::S0 | transferFlag);
         }
     }