Changeset 113253 in webkit for trunk/Source/JavaScriptCore/assembler

Timestamp:

Apr 4, 2012, 3:42:29 PM (13 years ago)

Author:

[email protected]

Message:

Constant Blinding for add/sub immediate crashes in ArmV7 when dest is SP
​https://bugs.webkit.org/show_bug.cgi?id=83191

Reviewed by Oliver Hunt.

Make are that blinded constant pairs are similarly aligned to the
original immediate values so that instructions that expect that
alignment work correctly. One example is ARMv7 add/sub imm to SP.

• assembler/ARMv7Assembler.h:

(JSC::ARMv7Assembler::add): Added ASSERT that immediate is word aligned.
(JSC::ARMv7Assembler::sub): Added ASSERT that immediate is word aligned.
(JSC::ARMv7Assembler::sub_S): Added ASSERT that immediate is word aligned.

• assembler/MacroAssembler.h:

(JSC::MacroAssembler::additionBlindedConstant):

Location:

trunk/Source/JavaScriptCore/assembler

Files:

• ARMv7Assembler.h (modified) (3 diffs)
• MacroAssembler.h (modified) (1 diff)

trunk/Source/JavaScriptCore/assembler/ARMv7Assembler.h

@@ -740 +740 @@
 
         if (rn == ARMRegisters::sp) {
+            ASSERT(!(imm.getUInt16() & 3));
             if (!(rd & 8) && imm.isUInt10()) {
                 m_formatter.oneWordOp5Reg3Imm8(OP_ADD_SP_imm_T1, rd, static_cast<uint8_t>(imm.getUInt10() >> 2));
@@ -1512 +1513 @@
 
         if ((rn == ARMRegisters::sp) && (rd == ARMRegisters::sp) && imm.isUInt9()) {
+            ASSERT(!(imm.getUInt16() & 3));
             m_formatter.oneWordOp9Imm7(OP_SUB_SP_imm_T1, static_cast<uint8_t>(imm.getUInt9() >> 2));
             return;
@@ -1573 +1575 @@
 
         if ((rn == ARMRegisters::sp) && (rd == ARMRegisters::sp) && imm.isUInt9()) {
+            ASSERT(!(imm.getUInt16() & 3));
             m_formatter.oneWordOp9Imm7(OP_SUB_SP_imm_T1, static_cast<uint8_t>(imm.getUInt9() >> 2));
             return;

trunk/Source/JavaScriptCore/assembler/MacroAssembler.h

@@ -700 +700 @@
     BlindedImm32 additionBlindedConstant(Imm32 imm)
     {
+        // The addition immediate may be used as a pointer offset. Keep aligned based on "imm".
+        static uint32_t maskTable[4] = { 0xfffffffc, 0xffffffff, 0xfffffffe, 0xffffffff };
+
         uint32_t baseValue = imm.asTrustedImm32().m_value;
-        uint32_t key = keyForConstant(baseValue);
+        uint32_t key = keyForConstant(baseValue) & maskTable[baseValue & 3];
         if (key > baseValue)
             key = key - baseValue;