dart-lang/sdk
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

[vm, compiler] Fix saving an invalid pointer to the stack in the BuildMethodExtractor stub.

Browse Source 
TEST=ci
Bug: https://github.com/dart-lang/sdk/issues/46796
Bug: https://github.com/dart-lang/sdk/issues/46954
Change-Id: I7e32fd28cdaebdf7b4ddde484a21cbe7c49f23e4
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/210620
Reviewed-by: Liam Appelbe <liama@google.com>
Commit-Queue: Ryan Macnak <rmacnak@google.com>
This commit is contained in:
Ryan Macnak
2021-08-23 20:05:27 +00:00
committed by commit-bot@chromium.org
parent 4bff21f56c
commit 0c165830b8
5 changed files with 104 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runtime/tests/vm/dart/regress_46796_test.dart
+32
View File
@@ -0,0 +1,32 @@
// Copyright (c) 2021, the Dart project authors. Please see the AUTHORS file
// for details. All rights reserved. Use of this source code is governed by a
// BSD-style license that can be found in the LICENSE file.
// VMOptions=
// VMOptions=--use_slow_path
class RawSocketEvent {}
class Stream<T> {}
class _RawSocket extends Stream<RawSocketEvent> {
int field1 = 512;
int field2 = -512;
_RawSocket() {
blackhole(_onSubscriptionStateChange);
}
void _onSubscriptionStateChange<T>() {
print("blah");
}
}
@pragma("vm:never-inline")
blackhole(x) {}
main() {
for (var i = 0; i < 10000000; i++) {
blackhole(new _RawSocket());
}
}
runtime/tests/vm/dart_2/regress_46796_test.dart
+34
View File
@@ -0,0 +1,34 @@
// Copyright (c) 2021, the Dart project authors. Please see the AUTHORS file
// for details. All rights reserved. Use of this source code is governed by a
// BSD-style license that can be found in the LICENSE file.
// VMOptions=
// VMOptions=--use_slow_path
// @dart = 2.9
class RawSocketEvent {}
class Stream<T> {}
class _RawSocket extends Stream<RawSocketEvent> {
int field1 = 512;
int field2 = -512;
_RawSocket() {
blackhole(_onSubscriptionStateChange);
}
void _onSubscriptionStateChange<T>() {
print("blah");
}
}
@pragma("vm:never-inline")
blackhole(x) {}
main() {
for (var i = 0; i < 10000000; i++) {
blackhole(new _RawSocket());
}
}
runtime/vm/compiler/stub_code_compiler_arm.cc
+12 -10
View File
@@ -243,16 +243,18 @@ void StubCodeCompiler::GenerateBuildMethodExtractorStub(
// Allocate context.
{
Label done, slow_path;
__ TryAllocateArray(kContextCid, target::Context::InstanceSize(1),
&slow_path,
R0, // instance
R1, // end address
R2, R3);
__ ldr(R1, Address(THR, target::Thread::object_null_offset()));
__ str(R1, FieldAddress(R0, target::Context::parent_offset()));
__ LoadImmediate(R1, 1);
__ str(R1, FieldAddress(R0, target::Context::num_variables_offset()));
__ b(&done);
if (!FLAG_use_slow_path && FLAG_inline_alloc) {
__ TryAllocateArray(kContextCid, target::Context::InstanceSize(1),
&slow_path,
R0, // instance
R1, // end address
R2, R3);
__ ldr(R1, Address(THR, target::Thread::object_null_offset()));
__ str(R1, FieldAddress(R0, target::Context::parent_offset()));
__ LoadImmediate(R1, 1);
__ str(R1, FieldAddress(R0, target::Context::num_variables_offset()));
__ b(&done);
}
__ Bind(&slow_path);
runtime/vm/compiler/stub_code_compiler_arm64.cc
+13 -11
View File
@@ -472,7 +472,7 @@ void StubCodeCompiler::GenerateBuildMethodExtractorStub(
__ cmp(R4, Operand(0));
__ b(&no_type_args, EQ);
__ ldr(R0, Address(FP, kReceiverOffset * target::kWordSize));
__ ldr(R3, Address(R0, R4));
__ LoadCompressed(R3, Address(R0, R4));
__ Bind(&no_type_args);
// Push type arguments & extracted method.
@@ -482,16 +482,18 @@ void StubCodeCompiler::GenerateBuildMethodExtractorStub(
// Allocate context.
{
Label done, slow_path;
__ TryAllocateArray(kContextCid, target::Context::InstanceSize(1),
&slow_path,
R0, // instance
R1, // end address
R2, R3);
__ ldr(R1, Address(THR, target::Thread::object_null_offset()));
__ str(R1, FieldAddress(R0, target::Context::parent_offset()));
__ LoadImmediate(R1, 1);
__ str(R1, FieldAddress(R0, target::Context::num_variables_offset()));
__ b(&done);
if (!FLAG_use_slow_path && FLAG_inline_alloc) {
__ TryAllocateArray(kContextCid, target::Context::InstanceSize(1),
&slow_path,
R0, // instance
R1, // end address
R2, R3);
__ ldr(R1, Address(THR, target::Thread::object_null_offset()));
__ str(R1, FieldAddress(R0, target::Context::parent_offset()));
__ LoadImmediate(R1, 1);
__ str(R1, FieldAddress(R0, target::Context::num_variables_offset()));
__ b(&done);
}
__ Bind(&slow_path);
runtime/vm/compiler/stub_code_compiler_x64.cc
+13 -11
View File
@@ -417,7 +417,7 @@ void StubCodeCompiler::GenerateBuildMethodExtractorStub(
__ cmpq(RDX, Immediate(0));
__ j(EQUAL, &no_type_args, Assembler::kNearJump);
__ movq(RAX, Address(RBP, target::kWordSize * kReceiverOffsetInWords));
__ movq(RCX, Address(RAX, RDX, TIMES_1, 0));
__ LoadCompressed(RCX, Address(RAX, RDX, TIMES_1, 0));
__ Bind(&no_type_args);
__ pushq(RCX);
@@ -427,16 +427,18 @@ void StubCodeCompiler::GenerateBuildMethodExtractorStub(
// Allocate context.
{
Label done, slow_path;
__ TryAllocateArray(kContextCid, target::Context::InstanceSize(1),
&slow_path, Assembler::kFarJump,
RAX, // instance
RSI, // end address
RDI);
__ movq(RSI, Address(THR, target::Thread::object_null_offset()));
__ movq(FieldAddress(RAX, target::Context::parent_offset()), RSI);
__ movq(FieldAddress(RAX, target::Context::num_variables_offset()),
Immediate(1));
__ jmp(&done);
if (!FLAG_use_slow_path && FLAG_inline_alloc) {
__ TryAllocateArray(kContextCid, target::Context::InstanceSize(1),
&slow_path, Assembler::kFarJump,
RAX, // instance
RSI, // end address
RDI);
__ movq(RSI, Address(THR, target::Thread::object_null_offset()));
__ movq(FieldAddress(RAX, target::Context::parent_offset()), RSI);
__ movq(FieldAddress(RAX, target::Context::num_variables_offset()),
Immediate(1));
__ jmp(&done);
}
__ Bind(&slow_path);