diff options
| author | Julien Brianceau <jbriance@cisco.com> | 2014-10-22 18:25:24 +0200 |
|---|---|---|
| committer | Julien Brianceau <jbriance@cisco.com> | 2015-02-09 16:44:51 +0000 |
| commit | 3a3681158677f319bce88eee75d2696b8231eb1f (patch) | |
| tree | 98294cfea2127dd9649f8d901780f8807366179e /Source/JavaScriptCore/assembler | |
| parent | ce4edc79a8cf0114e7306f0e577b34555d381221 (diff) | |
| download | qtwebkit-3a3681158677f319bce88eee75d2696b8231eb1f.tar.gz | |
Fix lots of crashes because of 4th argument register trampling.
https://bugs.webkit.org/show_bug.cgi?id=123421
Reviewed by Michael Saboff.
r3 register is the 4th argument register for ARM and also a scratch
register in the baseline JIT for this architecture. We can use r6
instead, as this used to be the timeoutCheckRegister and it is no
longer used since r148119.
* assembler/ARMAssembler.h: Temp register is now r6 instead of r3 for ARM.
* assembler/MacroAssemblerARMv7.h: Temp register is now r6 instead of r3 for ARMv7.
* dfg/DFGGPRInfo.h: Add r3 properly in GPRInfo for ARM.
* jit/JITStubs.cpp: Remove obsolete timeoutCheckRegister init.
* yarr/YarrJIT.cpp: Use r3 and not the new scratch register r6 and r8 register
doesn't need to be saved.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158208 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Change-Id: I5198a158e5e69d4e3a05b353abb60f28c0ab095e
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@theqtcompany.com>
Diffstat (limited to 'Source/JavaScriptCore/assembler')
| -rw-r--r-- | Source/JavaScriptCore/assembler/ARMAssembler.h | 4 | ||||
| -rw-r--r-- | Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h | 5 |
2 files changed, 3 insertions, 6 deletions
diff --git a/Source/JavaScriptCore/assembler/ARMAssembler.h b/Source/JavaScriptCore/assembler/ARMAssembler.h index c950e47bb..19db71dc6 100644 --- a/Source/JavaScriptCore/assembler/ARMAssembler.h +++ b/Source/JavaScriptCore/assembler/ARMAssembler.h @@ -41,10 +41,10 @@ namespace JSC { r0 = 0, r1, r2, - r3, S0 = r3, /* Same as thumb assembler. */ + r3, r4, r5, - r6, + r6, S0 = r6, r7, r8, r9, diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h index ac3cc8646..b7259810a 100644 --- a/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h +++ b/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h @@ -35,11 +35,8 @@ namespace JSC { class MacroAssemblerARMv7 : public AbstractMacroAssembler<ARMv7Assembler> { - // FIXME: switch dataTempRegister & addressTempRegister, or possibly use r7? - // - dTR is likely used more than aTR, and we'll get better instruction - // encoding if it's in the low 8 registers. static const RegisterID dataTempRegister = ARMRegisters::ip; - static const RegisterID addressTempRegister = ARMRegisters::r3; + static const RegisterID addressTempRegister = ARMRegisters::r6; static const ARMRegisters::FPDoubleRegisterID fpTempRegister = ARMRegisters::d7; inline ARMRegisters::FPSingleRegisterID fpTempRegisterAsSingle() { return ARMRegisters::asSingle(fpTempRegister); } |