From 3a3681158677f319bce88eee75d2696b8231eb1f Mon Sep 17 00:00:00 2001 From: Julien Brianceau Date: Wed, 22 Oct 2014 18:25:24 +0200 Subject: Fix lots of crashes because of 4th argument register trampling. https://bugs.webkit.org/show_bug.cgi?id=123421 Reviewed by Michael Saboff. r3 register is the 4th argument register for ARM and also a scratch register in the baseline JIT for this architecture. We can use r6 instead, as this used to be the timeoutCheckRegister and it is no longer used since r148119. * assembler/ARMAssembler.h: Temp register is now r6 instead of r3 for ARM. * assembler/MacroAssemblerARMv7.h: Temp register is now r6 instead of r3 for ARMv7. * dfg/DFGGPRInfo.h: Add r3 properly in GPRInfo for ARM. * jit/JITStubs.cpp: Remove obsolete timeoutCheckRegister init. * yarr/YarrJIT.cpp: Use r3 and not the new scratch register r6 and r8 register doesn't need to be saved. git-svn-id: http://svn.webkit.org/repository/webkit/trunk@158208 268f45cc-cd09-0410-ab3c-d52691b4dbfc Change-Id: I5198a158e5e69d4e3a05b353abb60f28c0ab095e Reviewed-by: Allan Sandfeld Jensen --- Source/JavaScriptCore/jit/JITStubs.cpp | 5 ----- 1 file changed, 5 deletions(-) (limited to 'Source/JavaScriptCore/jit/JITStubs.cpp') diff --git a/Source/JavaScriptCore/jit/JITStubs.cpp b/Source/JavaScriptCore/jit/JITStubs.cpp index 7aaa27867..9be418e56 100644 --- a/Source/JavaScriptCore/jit/JITStubs.cpp +++ b/Source/JavaScriptCore/jit/JITStubs.cpp @@ -653,7 +653,6 @@ SYMBOL_STRING(ctiTrampoline) ":" "\n" "str r11, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R11_OFFSET) "]" "\n" "str r1, [sp, #" STRINGIZE_VALUE_OF(REGISTER_FILE_OFFSET) "]" "\n" "mov r5, r2" "\n" - "mov r6, #512" "\n" "blx r0" "\n" "ldr r11, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R11_OFFSET) "]" "\n" "ldr r10, [sp, #" STRINGIZE_VALUE_OF(PRESERVED_R10_OFFSET) "]" "\n" @@ -730,7 +729,6 @@ SYMBOL_STRING(ctiTrampoline) ":" "\n" "stmdb sp!, {r4-r6, r8-r11, lr}" "\n" "sub sp, sp, #" STRINGIZE_VALUE_OF(PRESERVEDR4_OFFSET) "\n" "mov r5, r2" "\n" - "mov r6, #512" "\n" // r0 contains the code "blx r0" "\n" "add sp, sp, #" STRINGIZE_VALUE_OF(PRESERVEDR4_OFFSET) "\n" @@ -780,7 +778,6 @@ __asm EncodedJSValue ctiTrampoline(void*, JSStack*, CallFrame*, void* /*unused1* str r11, [sp, # PRESERVED_R11_OFFSET ] str r1, [sp, # REGISTER_FILE_OFFSET ] mov r5, r2 - mov r6, #512 blx r0 ldr r11, [sp, # PRESERVED_R11_OFFSET ] ldr r10, [sp, # PRESERVED_R10_OFFSET ] @@ -840,7 +837,6 @@ __asm EncodedJSValue ctiTrampoline(void*, JSStack*, CallFrame*, void* /*unused1* stmdb sp!, {r4-r6, r8-r11, lr} sub sp, sp, # PRESERVEDR4_OFFSET mov r5, r2 - mov r6, #512 mov lr, pc bx r0 add sp, sp, # PRESERVEDR4_OFFSET @@ -1387,7 +1383,6 @@ MSVC_BEGIN( stmdb sp!, {r1-r3}) MSVC_BEGIN( stmdb sp!, {r4-r6, r8-r11, lr}) MSVC_BEGIN( sub sp, sp, #68 ; sync with PRESERVEDR4_OFFSET) MSVC_BEGIN( mov r5, r2) -MSVC_BEGIN( mov r6, #512) MSVC_BEGIN( ; r0 contains the code) MSVC_BEGIN( mov lr, pc) MSVC_BEGIN( bx r0) -- cgit v1.2.1