1 files changed, 48 insertions, 23 deletions

diff --git a/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
index d883abf4f..43ea2ed5a 100644
--- a/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
+++ b/Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -51,14 +51,7 @@ public:
     // Magic number is the biggest useful offset we can get on ARMv7 with
     // a LDR_imm_T2 encoding
     static const int MaximumCompactPtrAlignedAddressOffset = 124;
-
-    MacroAssemblerARMv7()
-        : m_inUninterruptedSequence(false)
-    {
-    }
     
-    void beginUninterruptedSequence() { m_inUninterruptedSequence = true; }
-    void endUninterruptedSequence() { m_inUninterruptedSequence = false; }
     Vector<LinkRecord>& jumpsToLink() { return m_assembler.jumpsToLink(); }
     void* unlinkedCode() { return m_assembler.unlinkedCode(); }
     bool canCompact(JumpType jumpType) { return m_assembler.canCompact(jumpType); }
@@ -303,11 +296,6 @@ public:
         m_assembler.neg(srcDest, srcDest);
     }
 
-    void not32(RegisterID srcDest)
-    {
-        m_assembler.mvn(srcDest, srcDest);
-    }
-
     void or32(RegisterID src, RegisterID dest)
     {
         m_assembler.orr(dest, dest, src);
@@ -447,6 +435,11 @@ public:
 
     void xor32(TrustedImm32 imm, RegisterID src, RegisterID dest)
     {
+        if (imm.m_value == -1) {
+            m_assembler.mvn(dest, src);
+            return;
+        }
+
         ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
         if (armImm.isValid())
             m_assembler.eor(dest, src, armImm);
@@ -463,7 +456,10 @@ public:
 
     void xor32(TrustedImm32 imm, RegisterID dest)
     {
-        xor32(imm, dest, dest);
+        if (imm.m_value == -1)
+            m_assembler.mvn(dest, dest);
+        else
+            xor32(imm, dest, dest);
     }
     
 
@@ -527,6 +523,7 @@ private:
         unreachableForPlatform();
     }
 
+protected:
     void store32(RegisterID src, ArmAddress address)
     {
         if (address.type == ArmAddress::HasIndex)
@@ -541,6 +538,7 @@ private:
         }
     }
 
+private:
     void store8(RegisterID src, ArmAddress address)
     {
         if (address.type == ArmAddress::HasIndex)
@@ -723,6 +721,26 @@ public:
         store16(src, setupArmAddress(address));
     }
 
+#if ENABLE(JIT_CONSTANT_BLINDING)
+    static RegisterID scratchRegisterForBlinding() { return dataTempRegister; }
+    static bool shouldBlindForSpecificArch(uint32_t value)
+    {
+        ARMThumbImmediate immediate = ARMThumbImmediate::makeEncodedImm(value);
+
+        // Couldn't be encoded as an immediate, so assume it's untrusted.
+        if (!immediate.isValid())
+            return true;
+        
+        // If we can encode the immediate, we have less than 16 attacker
+        // controlled bits.
+        if (immediate.isEncodedImm())
+            return false;
+
+        // Don't let any more than 12 bits of an instruction word
+        // be controlled by an attacker.
+        return !immediate.isUInt12();
+    }
+#endif
 
     // Floating-point operations:
 
@@ -789,7 +807,7 @@ public:
 
     void storeDouble(FPRegisterID src, const void* address)
     {
-        move(ImmPtr(address), addressTempRegister);
+        move(TrustedImmPtr(address), addressTempRegister);
         storeDouble(src, addressTempRegister);
     }
 
@@ -883,6 +901,11 @@ public:
         m_assembler.vabs(dest, src);
     }
 
+    void negateDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vneg(dest, src);
+    }
+
     void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
     {
         m_assembler.vmov(fpTempRegisterAsSingle(), src);
@@ -954,7 +977,7 @@ public:
         // clamped to 0x80000000, so 2x dest is zero in this case. In the case of
         // overflow the result will be equal to -2.
         Jump underflow = branchAdd32(Zero, dest, dest, dataTempRegister);
-        Jump noOverflow = branch32(NotEqual, dataTempRegister, Imm32(-2));
+        Jump noOverflow = branch32(NotEqual, dataTempRegister, TrustedImm32(-2));
 
         // For BranchIfTruncateSuccessful, we branch if 'noOverflow' jumps.
         underflow.link(this);
@@ -1356,7 +1379,7 @@ public:
     {
         // Move the high bits of the address into addressTempRegister,
         // and load the value into dataTempRegister.
-        move(ImmPtr(dest.m_ptr), addressTempRegister);
+        move(TrustedImmPtr(dest.m_ptr), addressTempRegister);
         m_assembler.ldr(dataTempRegister, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
 
         // Do the add.
@@ -1369,7 +1392,7 @@ public:
             // we'll need to reload it with the high bits of the address afterwards.
             move(imm, addressTempRegister);
             m_assembler.add_S(dataTempRegister, dataTempRegister, addressTempRegister);
-            move(ImmPtr(dest.m_ptr), addressTempRegister);
+            move(TrustedImmPtr(dest.m_ptr), addressTempRegister);
         }
 
         // Store the result.
@@ -1401,6 +1424,13 @@ public:
         return branchMul32(cond, dataTempRegister, src, dest);
     }
 
+    Jump branchNeg32(ResultCondition cond, RegisterID srcDest)
+    {
+        ARMThumbImmediate zero = ARMThumbImmediate::makeUInt12(0);
+        m_assembler.sub_S(srcDest, zero, srcDest);
+        return Jump(makeBranch(cond));
+    }
+
     Jump branchOr32(ResultCondition cond, RegisterID src, RegisterID dest)
     {
         m_assembler.orr_S(dest, dest, src);
@@ -1586,10 +1616,6 @@ public:
     }
 
 protected:
-    bool inUninterruptedSequence()
-    {
-        return m_inUninterruptedSequence;
-    }
 
     ALWAYS_INLINE Jump jump()
     {
@@ -1697,8 +1723,7 @@ private:
     {
         ARMv7Assembler::relinkCall(call.dataLocation(), destination.executableAddress());
     }
-    
-    bool m_inUninterruptedSequence;
+
 };
 
 } // namespace JSC