From cbf3b0bcc745536ee97ca21a3f9a7e613f31bc18 Mon Sep 17 00:00:00 2001 From: svenpanne Date: Tue, 16 Dec 2014 06:20:15 -0800 Subject: [PATCH] More -fsanitize=vptr fixes. This actually fixes 3 different issues when accessing Operand1: * Object vs. HeapObject * Wrong defaults for equals/hash * silently dropping const TEST=test/mjsunit/regress/regress-441099.js BUG=chromium:441099 LOG=y Review URL: https://codereview.chromium.org/812563002 Cr-Commit-Position: refs/heads/master@{#25843} --- src/compiler/arm/instruction-selector-arm.cc | 2 +- src/compiler/arm64/instruction-selector-arm64.cc | 2 +- src/compiler/ia32/instruction-selector-ia32.cc | 2 +- src/compiler/instruction-selector-impl.h | 4 +- src/compiler/instruction-selector.cc | 2 +- src/compiler/mips/instruction-selector-mips.cc | 2 +- src/compiler/mips64/instruction-selector-mips64.cc | 2 +- src/compiler/operator.h | 14 ++++++ src/compiler/typer.cc | 2 +- src/compiler/x64/instruction-selector-x64.cc | 2 +- test/mjsunit/regress/regress-441099.js | 53 ++++++++++++++++++++++ 11 files changed, 77 insertions(+), 10 deletions(-) create mode 100644 test/mjsunit/regress/regress-441099.js diff --git a/src/compiler/arm/instruction-selector-arm.cc b/src/compiler/arm/instruction-selector-arm.cc index 52acdc8..ef9e89e 100644 --- a/src/compiler/arm/instruction-selector-arm.cc +++ b/src/compiler/arm/instruction-selector-arm.cc @@ -1017,7 +1017,7 @@ void InstructionSelector::VisitFloat64RoundTiesAway(Node* node) { void InstructionSelector::VisitCall(Node* node) { ArmOperandGenerator g(this); - CallDescriptor* descriptor = OpParameter(node); + const CallDescriptor* descriptor = OpParameter(node); FrameStateDescriptor* frame_state_descriptor = NULL; if (descriptor->NeedsFrameState()) { diff --git a/src/compiler/arm64/instruction-selector-arm64.cc b/src/compiler/arm64/instruction-selector-arm64.cc index 0922dac..ee493cb 100644 --- a/src/compiler/arm64/instruction-selector-arm64.cc +++ b/src/compiler/arm64/instruction-selector-arm64.cc @@ -1085,7 +1085,7 @@ void InstructionSelector::VisitFloat64RoundTiesAway(Node* node) { void InstructionSelector::VisitCall(Node* node) { Arm64OperandGenerator g(this); - CallDescriptor* descriptor = OpParameter(node); + const CallDescriptor* descriptor = OpParameter(node); FrameStateDescriptor* frame_state_descriptor = NULL; if (descriptor->NeedsFrameState()) { diff --git a/src/compiler/ia32/instruction-selector-ia32.cc b/src/compiler/ia32/instruction-selector-ia32.cc index 6b7c01e..16063ab 100644 --- a/src/compiler/ia32/instruction-selector-ia32.cc +++ b/src/compiler/ia32/instruction-selector-ia32.cc @@ -719,7 +719,7 @@ void InstructionSelector::VisitFloat64RoundTiesAway(Node* node) { void InstructionSelector::VisitCall(Node* node) { IA32OperandGenerator g(this); - CallDescriptor* descriptor = OpParameter(node); + const CallDescriptor* descriptor = OpParameter(node); FrameStateDescriptor* frame_state_descriptor = NULL; diff --git a/src/compiler/instruction-selector-impl.h b/src/compiler/instruction-selector-impl.h index d1e27f0..bdcd952 100644 --- a/src/compiler/instruction-selector-impl.h +++ b/src/compiler/instruction-selector-impl.h @@ -338,10 +338,10 @@ class FlagsContinuation FINAL { // TODO(bmeurer): Get rid of the CallBuffer business and make // InstructionSelector::VisitCall platform independent instead. struct CallBuffer { - CallBuffer(Zone* zone, CallDescriptor* descriptor, + CallBuffer(Zone* zone, const CallDescriptor* descriptor, FrameStateDescriptor* frame_state); - CallDescriptor* descriptor; + const CallDescriptor* descriptor; FrameStateDescriptor* frame_state_descriptor; NodeVector output_nodes; InstructionOperandVector outputs; diff --git a/src/compiler/instruction-selector.cc b/src/compiler/instruction-selector.cc index a91b7db..4f95b75 100644 --- a/src/compiler/instruction-selector.cc +++ b/src/compiler/instruction-selector.cc @@ -298,7 +298,7 @@ void InstructionSelector::MarkAsRepresentation(MachineType rep, Node* node) { // TODO(bmeurer): Get rid of the CallBuffer business and make // InstructionSelector::VisitCall platform independent instead. -CallBuffer::CallBuffer(Zone* zone, CallDescriptor* d, +CallBuffer::CallBuffer(Zone* zone, const CallDescriptor* d, FrameStateDescriptor* frame_desc) : descriptor(d), frame_state_descriptor(frame_desc), diff --git a/src/compiler/mips/instruction-selector-mips.cc b/src/compiler/mips/instruction-selector-mips.cc index b08d0e8..0ebb3cf 100644 --- a/src/compiler/mips/instruction-selector-mips.cc +++ b/src/compiler/mips/instruction-selector-mips.cc @@ -438,7 +438,7 @@ void InstructionSelector::VisitFloat64RoundTiesAway(Node* node) { void InstructionSelector::VisitCall(Node* node) { MipsOperandGenerator g(this); - CallDescriptor* descriptor = OpParameter(node); + const CallDescriptor* descriptor = OpParameter(node); FrameStateDescriptor* frame_state_descriptor = NULL; if (descriptor->NeedsFrameState()) { diff --git a/src/compiler/mips64/instruction-selector-mips64.cc b/src/compiler/mips64/instruction-selector-mips64.cc index 1d08bdf..0dba931 100644 --- a/src/compiler/mips64/instruction-selector-mips64.cc +++ b/src/compiler/mips64/instruction-selector-mips64.cc @@ -630,7 +630,7 @@ void InstructionSelector::VisitFloat64RoundTiesAway(Node* node) { void InstructionSelector::VisitCall(Node* node) { Mips64OperandGenerator g(this); - CallDescriptor* descriptor = OpParameter(node); + const CallDescriptor* descriptor = OpParameter(node); FrameStateDescriptor* frame_state_descriptor = NULL; if (descriptor->NeedsFrameState()) { diff --git a/src/compiler/operator.h b/src/compiler/operator.h index d6f80ad..fb144ce 100644 --- a/src/compiler/operator.h +++ b/src/compiler/operator.h @@ -172,6 +172,20 @@ inline T const& OpParameter(const Operator* op) { return static_cast*>(op)->parameter(); } +// NOTE: We have to be careful to use the right equal/hash functions below, for +// float/double we always use the ones operating on the bit level. +template <> +inline float const& OpParameter(const Operator* op) { + return static_cast, + base::bit_hash>*>(op)->parameter(); +} + +template <> +inline double const& OpParameter(const Operator* op) { + return static_cast, + base::bit_hash>*>(op)->parameter(); +} + } // namespace compiler } // namespace internal } // namespace v8 diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc index 2ab4ab5..9101e1d 100644 --- a/src/compiler/typer.cc +++ b/src/compiler/typer.cc @@ -626,7 +626,7 @@ Bounds Typer::Visitor::TypeNumberConstant(Node* node) { Bounds Typer::Visitor::TypeHeapConstant(Node* node) { - return Bounds(TypeConstant(OpParameter >(node).handle())); + return Bounds(TypeConstant(OpParameter >(node).handle())); } diff --git a/src/compiler/x64/instruction-selector-x64.cc b/src/compiler/x64/instruction-selector-x64.cc index 7ed5c08..2dfd401 100644 --- a/src/compiler/x64/instruction-selector-x64.cc +++ b/src/compiler/x64/instruction-selector-x64.cc @@ -922,7 +922,7 @@ void InstructionSelector::VisitFloat64RoundTiesAway(Node* node) { void InstructionSelector::VisitCall(Node* node) { X64OperandGenerator g(this); - CallDescriptor* descriptor = OpParameter(node); + const CallDescriptor* descriptor = OpParameter(node); FrameStateDescriptor* frame_state_descriptor = NULL; if (descriptor->NeedsFrameState()) { diff --git a/test/mjsunit/regress/regress-441099.js b/test/mjsunit/regress/regress-441099.js new file mode 100644 index 0000000..63aecfd --- /dev/null +++ b/test/mjsunit/regress/regress-441099.js @@ -0,0 +1,53 @@ +// Copyright 2014 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +var Module; +if (!Module) Module = eval('(function() { try { return Module || {} } catch(e) { return {} } })()'); +else if (ENVIRONMENT_IS_SHELL) { +} +var Runtime = { + stackSave: function () { + }, + alignMemory: function (quantum) { var ret = size = Math.ceil()*(quantum ? quantum : 8); return ret; }} +function allocate() { +} +function callRuntimeCallbacks(callbacks) { + var callback = callbacks.shift(); + var func = callback.func; + if (typeof func === 'number') { + } else { + func(); + } +} +var __ATINIT__ = []; // functions called during startup +function ensureInitRuntime() { + callRuntimeCallbacks(__ATINIT__); +} +/* global initializers */ __ATINIT__.push({ func: function() { runPostSets() } }); + function __formatString() { + switch (next) { + } + } + var Browser={mainLoop:{queue:[],pause:function () { + }},moduleContextCreatedCallbacks:[],workers:[],init:function () { + }}; +var asm = (function() { + 'use asm'; +function setThrew() { +} +function runPostSets() { +} +function _main() { +} +function _free() { +} + return { runPostSets: runPostSets}; +}) +(); +var runPostSets = Module["runPostSets"] = asm["runPostSets"]; +var i64Math = (function() { // Emscripten wrapper + /** + */ +})(); + ensureInitRuntime(); -- 2.7.4