mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-27 20:25:44 +00:00
Bug 1445907 - Save x28 before clobbering it in the regex compiler. r=sstangl
This commit is contained in:
parent
e9acb1b498
commit
0c6dd4a750
@ -123,7 +123,15 @@ NativeRegExpMacroAssembler::GenerateCode(JSContext* cx, bool match_only)
|
||||
masm.bind(&entry_label_);
|
||||
|
||||
#ifdef JS_CODEGEN_ARM64
|
||||
// ARM64 communicates stack address via sp, but uses a pseudo-sp for addressing.
|
||||
// ARM64 communicates stack address via SP, but uses a pseudo-sp (PSP) for
|
||||
// addressing. The register we use for PSP may however also be used by
|
||||
// calling code, and it is nonvolatile, so save it. Do this as a special
|
||||
// case first because the generic save/restore code needs the PSP to be
|
||||
// initialized already.
|
||||
MOZ_ASSERT(PseudoStackPointer64.Is(masm.GetStackPointer64()));
|
||||
masm.Str(PseudoStackPointer64, vixl::MemOperand(sp, -16, vixl::PreIndex));
|
||||
|
||||
// Initialize the PSP from the SP.
|
||||
masm.initStackPtr();
|
||||
#endif
|
||||
|
||||
@ -421,7 +429,22 @@ NativeRegExpMacroAssembler::GenerateCode(JSContext* cx, bool match_only)
|
||||
for (GeneralRegisterBackwardIterator iter(savedNonVolatileRegisters); iter.more(); ++iter)
|
||||
masm.Pop(*iter);
|
||||
|
||||
#ifdef JS_CODEGEN_ARM64
|
||||
// Now restore the value that was in the PSP register on entry, and return.
|
||||
|
||||
// Obtain the correct SP from the PSP.
|
||||
masm.Mov(sp, PseudoStackPointer64);
|
||||
|
||||
// Restore the saved value of the PSP register, this value is whatever the
|
||||
// caller had saved in it, not any actual SP value, and it must not be
|
||||
// overwritten subsequently.
|
||||
masm.Ldr(PseudoStackPointer64, vixl::MemOperand(sp, 16, vixl::PostIndex));
|
||||
|
||||
// Perform a plain Ret(), as abiret() will move SP <- PSP and that is wrong.
|
||||
masm.Ret(vixl::lr);
|
||||
#else
|
||||
masm.abiret();
|
||||
#endif
|
||||
|
||||
// Backtrack code (branch target for conditional backtracks).
|
||||
if (backtrack_label_.used()) {
|
||||
|
15
js/src/jit-test/tests/regexp/bug1445907.js
Normal file
15
js/src/jit-test/tests/regexp/bug1445907.js
Normal file
@ -0,0 +1,15 @@
|
||||
// On ARM64, we failed to save x28 properly when generating code for the regexp
|
||||
// matcher.
|
||||
//
|
||||
// There's wasm and Debugger code here because the combination forces the use of
|
||||
// x28 and exposes the bug when running on the simulator.
|
||||
|
||||
if (!wasmIsSupported())
|
||||
quit();
|
||||
|
||||
var g = newGlobal('');
|
||||
var dbg = new Debugger(g);
|
||||
g.eval(`var m = new WebAssembly.Instance(new WebAssembly.Module(wasmTextToBinary('(module (func (export "test")))')))`);
|
||||
var re = /./;
|
||||
dbg.onEnterFrame = function(frame) { re.exec("x") };
|
||||
result = g.eval("m.exports.test()");
|
Loading…
Reference in New Issue
Block a user