Attachment 393948 Details for Bug 199295 – Patch

[patch] Patch

bug-199295-20200318213311.patch (text/plain), 1.87 KB, created by Yusuke Suzuki on 2020-03-18 21:33:12 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Yusuke Suzuki

Created: 2020-03-18 21:33:12 PDT

Size: 1.87 KB

patch

obsolete

>Subversion Revision: 258679
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 2776e8dc31b6fa02e671fcb6170e655304ab87d2..3f7b3ca1d27ad043895894cfefe96ac1f43b8c5f 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,15 @@
>+2020-03-18  Yusuke Suzuki  <ysuzuki@apple.com>
>+
>+        sanitizeStackForVMImpl writes below stack pointer, triggers huge warning spam from valgrind
>+        https://bugs.webkit.org/show_bug.cgi?id=199295
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        During sanitizeStackForVMImpl, we should not access to the region beyond the stack-pointer.
>+        This patch changes stack-pointer while sanitizeStackForVMImpl is zero-filling the old stack region.
>+
>+        * llint/LowLevelInterpreter.asm:
>+
> 2020-03-18  Yusuke Suzuki  <ysuzuki@apple.com>
> 
>         Add a way to mark a rejected promise as handled
>diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
>index 1029554218962950d3d8c07e2f10857d73e3af00..847b360484e982ea8cbd7ea9b06347fb67d272fa 100644
>--- a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
>+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
>@@ -1423,17 +1423,20 @@ if not (C_LOOP or C_LOOP_WIN)
>         const zeroValue = a2
>     
>         loadp VM::m_lastStackTop[vm], address
>+        storep sp, VM::m_lastStackTop[vm]
>+        move sp, vm
>+
>         bpbeq sp, address, .zeroFillDone
>-    
>+        move address, sp
>+
>         move 0, zeroValue
>     .zeroFillLoop:
>         storep zeroValue, [address]
>         addp PtrSize, address
>-        bpa sp, address, .zeroFillLoop
>+        bpa vm, address, .zeroFillLoop
> 
>     .zeroFillDone:
>-        move sp, address
>-        storep address, VM::m_lastStackTop[vm]
>+        move vm, sp
>         ret
>     
>     # VMEntryRecord* vmEntryRecord(const EntryFrame* entryFrame)

Actions: View | Formatted Diff | Diff

Attachments on bug 199295: 393948 | 393950