Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-27 20:25:44 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1445907 - Save x28 before clobbering it in the regex compiler. r=sstangl

Browse Source
This commit is contained in:
Lars T Hansen 2018-03-19 09:58:06 +01:00
parent e9acb1b498
commit 0c6dd4a750
2 changed files with 39 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
js/src/irregexp/NativeRegExpMacroAssembler.cpp
View File

@ -123,7 +123,15 @@ NativeRegExpMacroAssembler::GenerateCode(JSContext* cx, bool match_only)
masm.bind(&entry_label_);
#ifdef JS_CODEGEN_ARM64
// ARM64 communicates stack address via sp, but uses a pseudo-sp for addressing.
// ARM64 communicates stack address via SP, but uses a pseudo-sp (PSP) for
// addressing. The register we use for PSP may however also be used by
// calling code, and it is nonvolatile, so save it. Do this as a special
// case first because the generic save/restore code needs the PSP to be
// initialized already.
MOZ_ASSERT(PseudoStackPointer64.Is(masm.GetStackPointer64()));
masm.Str(PseudoStackPointer64, vixl::MemOperand(sp, -16, vixl::PreIndex));
// Initialize the PSP from the SP.
masm.initStackPtr();
#endif
@ -421,7 +429,22 @@ NativeRegExpMacroAssembler::GenerateCode(JSContext* cx, bool match_only)
for (GeneralRegisterBackwardIterator iter(savedNonVolatileRegisters); iter.more(); ++iter)
masm.Pop(*iter);
#ifdef JS_CODEGEN_ARM64
// Now restore the value that was in the PSP register on entry, and return.
// Obtain the correct SP from the PSP.
masm.Mov(sp, PseudoStackPointer64);
// Restore the saved value of the PSP register, this value is whatever the
// caller had saved in it, not any actual SP value, and it must not be
// overwritten subsequently.
masm.Ldr(PseudoStackPointer64, vixl::MemOperand(sp, 16, vixl::PostIndex));
// Perform a plain Ret(), as abiret() will move SP <- PSP and that is wrong.
masm.Ret(vixl::lr);
#else
masm.abiret();
#endif
// Backtrack code (branch target for conditional backtracks).
if (backtrack_label_.used()) {

15
js/src/jit-test/tests/regexp/bug1445907.js Normal file
View File

@ -0,0 +1,15 @@
// On ARM64, we failed to save x28 properly when generating code for the regexp
// matcher.
//
// There's wasm and Debugger code here because the combination forces the use of
// x28 and exposes the bug when running on the simulator.
if (!wasmIsSupported())
quit();
var g = newGlobal('');
var dbg = new Debugger(g);
g.eval(`var m = new WebAssembly.Instance(new WebAssembly.Module(wasmTextToBinary('(module (func (export "test")))')))`);
var re = /./;
dbg.onEnterFrame = function(frame) { re.exec("x") };
result = g.eval("m.exports.test()");