AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[maglev] Fix temp use in StringLength

Browse Source 
Avoid clobbering the object register when it aliases the result register
in StringLength.

Bug: v8:7700
Change-Id: Ib96522ca89313ae7c54af829d8f9743d1ab7d705
Fixed: chromium:1374231
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3952593
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83691}
This commit is contained in:
Leszek Swirski 2022-10-13 16:07:12 +02:00 committed by V8 LUCI CQ
parent 0bee317369
commit 2e80478fe6
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/maglev/maglev-ir.cc
View File

@ -1837,13 +1837,16 @@ void StringLength::GenerateCode(MaglevAssembler* masm,
const ProcessingState& state) {
Register object = ToRegister(object_input());
if (v8_flags.debug_code) {
// Use return register as temporary.
// Use return register as temporary. Push it in case it aliases the object
// register.
Register tmp = ToRegister(result());
__ Push(tmp);
// Check if {object} is a string.
__ AssertNotSmi(object);
__ LoadMap(tmp, object);
__ CmpInstanceTypeRange(tmp, tmp, FIRST_STRING_TYPE, LAST_STRING_TYPE);
__ Check(below_equal, AbortReason::kUnexpectedValue);
__ Pop(tmp);
}
__ movl(ToRegister(result()), FieldOperand(object, String::kLengthOffset));
}