Home Explore 引导页 在线工具 Blog
Register Sign In
Pchen0
/
electron
1
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Tree: 3b1cdbb563
Branches Tags
electron
/
patches
/
v8
/
m126-lts_liftoff_fix_clobbered_scratch_register.patch

m126-lts_liftoff_fix_clobbered_scratch_register.patch 3.5 KB
History Raw

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980 
  1. From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
    2. 

  2. From: Clemens Backes <[email protected]>
    3. 

  3. Date: Fri, 15 Nov 2024 16:00:15 +0100
    4. 

  4. Subject: Fix clobbered scratch register
    5. 

  5. 

  6. `GetMemOp` returns an `Operand` which can contain `kScratchRegister`. We
    7. 

  7. should hence not clobber that register until after the last use of the
    8. 

  8. `Operand`.
    9. 

  9. 

  10. This CL changes the scratch register to `kScratchRegister2` which has
    11. 

  11. much fewer uses, and in particular none which collides with `GetMemOp`.
    12. 

  12. 

  13. [email protected]
    14. 

  14. 

  15. (cherry picked from commit 57a017e611a5abfb0e4b59f6de028bc4070a3615)
    16. 

  16. 

  17. Fixed: 378779897, 378701682
    18. 

  18. Change-Id: Id1ed25edfe76200d069ac2ab54e5000eed313c8f
    19. 

  19. Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6022072
    20. 

  20. Reviewed-by: Matthias Liedtke <[email protected]>
    21. 

  21. Commit-Queue: Clemens Backes <[email protected]>
    22. 

  22. Cr-Original-Commit-Position: refs/heads/main@{#97224}
    23. 

  23. Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6056706
    24. 

  24. Reviewed-by: Clemens Backes <[email protected]>
    25. 

  25. Commit-Queue: Gyuyoung Kim (xWF) <[email protected]>
    26. 

  26. Reviewed-by: Daniel Lehmann <[email protected]>
    27. 

  27. Cr-Commit-Position: refs/branch-heads/12.6@{#82}
    28. 

  28. Cr-Branched-From: 3c9fa12db3183a6f4ea53d2675adb66ea1194529-refs/heads/12.6.228@{#2}
    29. 

  29. Cr-Branched-From: 981bb15ba4dbf9e2381dfc94ec2c4af0b9c6a0b6-refs/heads/main@{#93835}
    30. 

  30. 

  31. diff --git a/src/wasm/baseline/x64/liftoff-assembler-x64-inl.h b/src/wasm/baseline/x64/liftoff-assembler-x64-inl.h
    32. 

  32. index b20867d7ec2a5724653ebe9baca8c8949d70cd74..be01772c27382e2c10314777e4058cf326327ba3 100644
    33. 

  33. --- a/src/wasm/baseline/x64/liftoff-assembler-x64-inl.h
    34. 

  34. +++ b/src/wasm/baseline/x64/liftoff-assembler-x64-inl.h
    35. 

  35. @@ -50,6 +50,8 @@ constexpr Operand kInstanceDataOperand =
    36. 

  36.  
    37. 

  37.  constexpr Operand kOSRTargetSlot = GetStackSlot(kOSRTargetOffset);
    38. 

  38.  
    39. 

  39. +// Note: The returned Operand might contain {kScratchRegister2}; make sure not
    40. 

  40. +// to clobber that until after the last use of the Operand.
    41. 

  41.  inline Operand GetMemOp(LiftoffAssembler* assm, Register addr,
    42. 

  42.                          Register offset_reg, uintptr_t offset_imm,
    43. 

  43.                          ScaleFactor scale_factor = times_1) {
    44. 

  44. @@ -60,7 +62,7 @@ inline Operand GetMemOp(LiftoffAssembler* assm, Register addr,
    45. 

  45.                 : Operand(addr, offset_reg, scale_factor, offset_imm32);
    46. 

  46.    }
    47. 

  47.    // Offset immediate does not fit in 31 bits.
    48. 

  48. -  Register scratch = kScratchRegister;
    49. 

  49. +  Register scratch = kScratchRegister2;
    50. 

  50.    assm->MacroAssembler::Move(scratch, offset_imm);
    51. 

  51.    if (offset_reg != no_reg) assm->addq(scratch, offset_reg);
    52. 

  52.    return Operand(addr, scratch, scale_factor, 0);
    53. 

  53. diff --git a/test/mjsunit/regress/wasm/regress-378779897.js b/test/mjsunit/regress/wasm/regress-378779897.js
    54. 

  54. new file mode 100644
    55. 

  55. index 0000000000000000000000000000000000000000..fed1bc807165e1b9e83195a2df30aac33a544470
    56. 

  56. --- /dev/null
    57. 

  57. +++ b/test/mjsunit/regress/wasm/regress-378779897.js
    58. 

  58. @@ -0,0 +1,22 @@
    59. 

  59. +// Copyright 2024 the V8 project authors. All rights reserved.
    60. 

  60. +// Use of this source code is governed by a BSD-style license that can be
    61. 

  61. +// found in the LICENSE file.
    62. 

  62. +
    63. 

  63. +d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
    64. 

  64. +
    65. 

  65. +const builder = new WasmModuleBuilder();
    66. 

  66. +builder.addMemory(49149);
    67. 

  67. +
    68. 

  68. +builder.addFunction('main', kSig_i_v).addBody([
    69. 

  69. +  ...wasmI32Const(-1118406780),
    70. 

  70. +  ...wasmI32Const(-1),
    71. 

  71. +  kAtomicPrefix, kExprI32AtomicOr8U, 0, 0
    72. 

  72. +]).exportFunc();
    73. 

  73. +
    74. 

  74. +let instance;
    75. 

  75. +try {
    76. 

  76. +  instance = builder.instantiate();
    77. 

  77. +} catch (e) {
    78. 

  78. +  assertException(e, RangeError, /Out of memory/);
    79. 

  79. +}
    80. 

  80. +if (instance) instance.exports.main();
    81.