AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

MIPS: Fix uninitialized FixedArray potentially being left behind by ElementsTransitionGenerator::GenerateDoubleToObject.

Browse Source 
Port r24498 (eeef8c0)

BUG=chromium:421843
LOG=n
R=paul.lind@imgtec.com

Review URL: https://codereview.chromium.org/645633002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24502 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
balazs.kilvady@imgtec.com 2014-10-09 17:06:17 +00:00
parent 69cc49ce46
commit d6013e940c
2 changed files with 30 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/mips/codegen-mips.cc
View File

@ -896,9 +896,23 @@ void ElementsTransitionGenerator::GenerateDoubleToObject(
FixedDoubleArray::kHeaderSize - kHeapObjectTag
+ Register::kExponentOffset));
__ Addu(dst_elements, array, Operand(FixedArray::kHeaderSize));
__ Addu(array, array, Operand(kHeapObjectTag));
__ sll(dst_end, dst_end, 1);
__ Addu(dst_end, dst_elements, dst_end);
// Allocating heap numbers in the loop below can fail and cause a jump to
// gc_required. We can't leave a partly initialized FixedArray behind,
// so pessimistically fill it with holes now.
Label initialization_loop, initialization_loop_entry;
__ LoadRoot(scratch, Heap::kTheHoleValueRootIndex);
__ Branch(&initialization_loop_entry);
__ bind(&initialization_loop);
__ sw(scratch, MemOperand(dst_elements));
__ Addu(dst_elements, dst_elements, Operand(kPointerSize));
__ bind(&initialization_loop_entry);
__ Branch(&initialization_loop, lt, dst_elements, Operand(dst_end));
__ Addu(dst_elements, array, Operand(FixedArray::kHeaderSize));
__ Addu(array, array, Operand(kHeapObjectTag));
__ LoadRoot(heap_number_map, Heap::kHeapNumberMapRootIndex);
// Using offsetted addresses.
// dst_elements: begin of destination FixedArray element fields, not tagged

16
src/mips64/codegen-mips64.cc
View File

@ -786,9 +786,23 @@ void ElementsTransitionGenerator::GenerateDoubleToObject(
__ Daddu(src_elements, src_elements,
Operand(FixedDoubleArray::kHeaderSize - kHeapObjectTag + 4));
__ Daddu(dst_elements, array, Operand(FixedArray::kHeaderSize));
__ Daddu(array, array, Operand(kHeapObjectTag));
__ SmiScale(dst_end, dst_end, kPointerSizeLog2);
__ Daddu(dst_end, dst_elements, dst_end);
// Allocating heap numbers in the loop below can fail and cause a jump to
// gc_required. We can't leave a partly initialized FixedArray behind,
// so pessimistically fill it with holes now.
Label initialization_loop, initialization_loop_entry;
__ LoadRoot(scratch, Heap::kTheHoleValueRootIndex);
__ Branch(&initialization_loop_entry);
__ bind(&initialization_loop);
__ sd(scratch, MemOperand(dst_elements));
__ Daddu(dst_elements, dst_elements, Operand(kPointerSize));
__ bind(&initialization_loop_entry);
__ Branch(&initialization_loop, lt, dst_elements, Operand(dst_end));
__ Daddu(dst_elements, array, Operand(FixedArray::kHeaderSize));
__ Daddu(array, array, Operand(kHeapObjectTag));
__ LoadRoot(heap_number_map, Heap::kHeapNumberMapRootIndex);
// Using offsetted addresses.
// dst_elements: begin of destination FixedArray element fields, not tagged