AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[ubsan] Fix integer overflow in compiler

Browse Source 
Negating the maximum int32 failed in ubsan. Use
{base::NegateWithWraparound} to avoid UB.

R=jkummerow@chromium.org

Bug: chromium:980007
Change-Id: If52a3bb3158eb5b465e7bd29deaffc0b18660360
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1683993
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62470}
This commit is contained in:
Clemens Hammacher 2019-07-01 13:12:49 +02:00 committed by Commit Bot
parent f03430fe4c
commit a420d20c07
2 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/compiler/backend/x64/instruction-selector-x64.cc
View File

@ -898,7 +898,8 @@ void InstructionSelector::VisitInt32Sub(Node* node) {
// Omit truncation and turn subtractions of constant values into immediate
// "leal" instructions by negating the value.
Emit(kX64Lea32 | AddressingModeField::encode(kMode_MRI),
g.DefineAsRegister(node), int64_input, g.TempImmediate(-imm));
g.DefineAsRegister(node), int64_input,
g.TempImmediate(base::NegateWithWraparound(imm)));
}
return;
}

14
test/mjsunit/regress/wasm/regress-980007.js Normal file
View File

@ -0,0 +1,14 @@
// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
load('test/mjsunit/wasm/wasm-module-builder.js');
const builder = new WasmModuleBuilder();
builder.addFunction(undefined, kSig_i_i).addBody([
kExprI64Const, 0x01,
kExprI32ConvertI64,
kExprI32Const, 0x80, 0x80, 0x80, 0x80, 0x78,
kExprI32Sub,
]);
builder.instantiate();