Differential D15565 Diff 46000 head/mail/thunderbird/files/patch-bug1445907

Changeset View

Standalone View

head/mail/thunderbird/files/patch-bug1445907

Property	Old Value	New Value
fbsd:nokeywords	null	yes \ No newline at end of property
svn:eol-style	null	native \ No newline at end of property
svn:mime-type	null	text/plain \ No newline at end of property

				commit 0c6dd4a750db
				Author: Lars T Hansen <lhansen@mozilla.com>
				Date: Mon Mar 19 09:58:06 2018 +0100

				Bug 1445907 - Save x28 before clobbering it in the regex compiler. r=sstangl
				---
				js/src/irregexp/NativeRegExpMacroAssembler.cpp \| 25 ++++++++++++++++++++++++-
				js/src/jit-test/tests/regexp/bug1445907.js \| 15 +++++++++++++++
				2 files changed, 39 insertions(+), 1 deletion(-)

				diff --git js/src/irregexp/NativeRegExpMacroAssembler.cpp js/src/irregexp/NativeRegExpMacroAssembler.cpp
				index 28a4c35e75bfe..c08b005cf856b 100644
				--- js/src/irregexp/NativeRegExpMacroAssembler.cpp
				+++ js/src/irregexp/NativeRegExpMacroAssembler.cpp
				@@ -123,7 +123,15 @@ NativeRegExpMacroAssembler::GenerateCode(JSContext* cx, bool match_only)
				masm.bind(&entry_label_);

				#ifdef JS_CODEGEN_ARM64
				- // ARM64 communicates stack address via sp, but uses a pseudo-sp for addressing.
				+ // ARM64 communicates stack address via SP, but uses a pseudo-sp (PSP) for
				+ // addressing. The register we use for PSP may however also be used by
				+ // calling code, and it is nonvolatile, so save it. Do this as a special
				+ // case first because the generic save/restore code needs the PSP to be
				+ // initialized already.
				+ MOZ_ASSERT(PseudoStackPointer64.Is(masm.GetStackPointer64()));
				+ masm.Str(PseudoStackPointer64, vixl::MemOperand(sp, -16, vixl::PreIndex));
				+
				+ // Initialize the PSP from the SP.
				masm.initStackPtr();
				#endif

				@@ -421,7 +429,22 @@ NativeRegExpMacroAssembler::GenerateCode(JSContext* cx, bool match_only)
				for (GeneralRegisterBackwardIterator iter(savedNonVolatileRegisters); iter.more(); ++iter)
				masm.Pop(*iter);

				+#ifdef JS_CODEGEN_ARM64
				+ // Now restore the value that was in the PSP register on entry, and return.
				+
				+ // Obtain the correct SP from the PSP.
				+ masm.Mov(sp, PseudoStackPointer64);
				+
				+ // Restore the saved value of the PSP register, this value is whatever the
				+ // caller had saved in it, not any actual SP value, and it must not be
				+ // overwritten subsequently.
				+ masm.Ldr(PseudoStackPointer64, vixl::MemOperand(sp, 16, vixl::PostIndex));
				+
				+ // Perform a plain Ret(), as abiret() will move SP <- PSP and that is wrong.
				+ masm.Ret(vixl::lr);
				+#else
				masm.abiret();
				+#endif

				// Backtrack code (branch target for conditional backtracks).
				if (backtrack_label_.used()) {
				diff --git js/src/jit-test/tests/regexp/bug1445907.js js/src/jit-test/tests/regexp/bug1445907.js
				new file mode 100644
				index 0000000000000..75b23753eaf93
				--- /dev/null
				+++ js/src/jit-test/tests/regexp/bug1445907.js
				@@ -0,0 +1,15 @@
				+// On ARM64, we failed to save x28 properly when generating code for the regexp
				+// matcher.
				+//
				+// There's wasm and Debugger code here because the combination forces the use of
				+// x28 and exposes the bug when running on the simulator.
				+
				+if (!wasmIsSupported())
				+ quit();
				+
				+var g = newGlobal('');
				+var dbg = new Debugger(g);
				+g.eval(`var m = new WebAssembly.Instance(new WebAssembly.Module(wasmTextToBinary('(module (func (export "test")))')))`);
				+var re = /./;
				+dbg.onEnterFrame = function(frame) { re.exec("x") };
				+result = g.eval("m.exports.test()");