116315 2013-05-17 07:36:35 -0700 DFG_OPERATIONs with double arguments generate incorrect code on ARM soft-fp 2013-11-19 04:57:28 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED DUPLICATE 117281 P2 Normal --- 108645 0 zhroma webkit-unassigned darin ossy oldest_to_newest 890356 0 zhroma 2013-05-17 07:36:35 -0700 I found that on ARMv7 Linux, with -mfloat-abi=softfp, v8-splay.js test crashes (segmentation fault). Also stanford-crypto-aes test from Kraken shows wrong results. The problem happens when calling DFG_OPERATIONs operationArrayPushDouble, operationPutDoubleByValBeyondArrayBoundsStrict, operationPutDoubleByValBeyondArrayBoundsNonStrict. One of their arguments is double, and all of them receive wrong last argument from DFG assembly. I fixed the setupArgumentsWithExecState function to prepare arguments in a proper way (as expected by AAPCS and GCC). There are two layout tests in the patch: array-with-double-dfg-push checks push(double) operations, array-with-double-dfg-assign checks assignment of double element beyond the array bounds. 890359 1 202085 zhroma 2013-05-17 07:41:37 -0700 Created attachment 202085 Proposed patch 946727 2 202085 mhahnenberg 2013-11-04 10:40:17 -0800 Comment on attachment 202085 Proposed patch View in context: https://bugs.webkit.org/attachment.cgi?id=202085&action=review Sorry, could you rebase? It makes getting context for the review easier. > Source/JavaScriptCore/dfg/DFGCCallHelpers.h:580 > #endif // CPU(ARM_HARDFP) I'm no expert, but is this the #define for ARM_HARDFP? Why are we assuming the softfp ABI inside of this #define? 946732 3 202085 ossy 2013-11-04 10:49:51 -0800 Comment on attachment 202085 Proposed patch View in context: https://bugs.webkit.org/attachment.cgi?id=202085&action=review >> Source/JavaScriptCore/dfg/DFGCCallHelpers.h:580 >> #endif // CPU(ARM_HARDFP) > > I'm no expert, but is this the #define for ARM_HARDFP? Why are we assuming the softfp ABI inside of this #define? This #endif comment is very very misleading, because it is the end of the _else_ case of CPU(ARM_HARDFP). (Otherwise this file is moved to Source/JavaScriptCore/jit/CCallHelpers.h.) 952032 4 zhroma 2013-11-19 04:40:05 -0800 (In reply to comment #2) > Sorry, could you rebase? It makes getting context for the review easier. This bug was already fixed here https://bugs.webkit.org/show_bug.cgi?id=117281 952036 5 ossy 2013-11-19 04:57:01 -0800 *** This bug has been marked as a duplicate of bug 117281 *** 202085 2013-05-17 07:41:37 -0700 2013-11-19 04:57:28 -0800 Proposed patch ccall.patch text/plain 6754 zhroma ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv ZwppbmRleCBhZTI0ODQxLi5kYjgwYTczIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VM b2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTkgQEAKKzIwMTMtMDUt MTcgIFJvbWFuIFpodXlrb3YgIDx6aHJvbWFAaXNwcmFzLnJ1PgorCisgICAgICAgIERvdWJsZSBh cnJheSBlbGVtZW50IHB1c2hlcyBhbmQgYXNzaWdubWVudHMgc2hvdWxkIGJlIG9wdGltaXplZCBj b3JyZWN0bHkuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9p ZD0xMTYzMTUKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAg ICAqIGZhc3QvanMvcmVncmVzcy9hcnJheS13aXRoLWRvdWJsZS1kZmctYXNzaWduLWV4cGVjdGVk LnR4dDogQWRkZWQuCisgICAgICAgICogZmFzdC9qcy9yZWdyZXNzL2FycmF5LXdpdGgtZG91Ymxl LWRmZy1hc3NpZ24uaHRtbDogQWRkZWQuCisgICAgICAgICogZmFzdC9qcy9yZWdyZXNzL2FycmF5 LXdpdGgtZG91YmxlLWRmZy1wdXNoLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogZmFz dC9qcy9yZWdyZXNzL2FycmF5LXdpdGgtZG91YmxlLWRmZy1wdXNoLmh0bWw6IEFkZGVkLgorICAg ICAgICAqIGZhc3QvanMvcmVncmVzcy9zY3JpcHQtdGVzdHMvYXJyYXktd2l0aC1kb3VibGUtZGZn LWFzc2lnbi5qczogQWRkZWQuCisgICAgICAgIChmb28pOgorICAgICAgICAqIGZhc3QvanMvcmVn cmVzcy9zY3JpcHQtdGVzdHMvYXJyYXktd2l0aC1kb3VibGUtZGZnLXB1c2guanM6IEFkZGVkLgor ICAgICAgICAoZm9vKToKKwogMjAxMy0wNS0xNiAgU2Vva2p1IEt3b24gIDxzZW9ranUua3dvbkBn bWFpbC5jb20+CiAKICAgICAgICAgW0VGTF0gaW5zcGVjdG9yLXByb3RvY29sL3BhZ2UvamF2YXNj cmlwdERpYWxvZ0V2ZW50cy5odG1sIGlzIGZhaWxpbmcKZGlmZiAtLWdpdCBhL0xheW91dFRlc3Rz L2Zhc3QvanMvcmVncmVzcy9hcnJheS13aXRoLWRvdWJsZS1kZmctYXNzaWduLWV4cGVjdGVkLnR4 dCBiL0xheW91dFRlc3RzL2Zhc3QvanMvcmVncmVzcy9hcnJheS13aXRoLWRvdWJsZS1kZmctYXNz aWduLWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi5hMGNl M2Y1Ci0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9qcy9yZWdyZXNzL2FycmF5 LXdpdGgtZG91YmxlLWRmZy1hc3NpZ24tZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEsMTAgQEAKK0pT UmVncmVzcy9hcnJheS13aXRoLWRvdWJsZS1kZmctYXNzaWduCisKK09uIHN1Y2Nlc3MsIHlvdSB3 aWxsIHNlZSBhIHNlcmllcyBvZiAiUEFTUyIgbWVzc2FnZXMsIGZvbGxvd2VkIGJ5ICJURVNUIENP TVBMRVRFIi4KKworCitQQVNTIG5vIGV4Y2VwdGlvbiB0aHJvd24KK1BBU1Mgc3VjY2Vzc2Z1bGx5 UGFyc2VkIGlzIHRydWUKKworVEVTVCBDT01QTEVURQorCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0 cy9mYXN0L2pzL3JlZ3Jlc3MvYXJyYXktd2l0aC1kb3VibGUtZGZnLWFzc2lnbi5odG1sIGIvTGF5 b3V0VGVzdHMvZmFzdC9qcy9yZWdyZXNzL2FycmF5LXdpdGgtZG91YmxlLWRmZy1hc3NpZ24uaHRt bApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi42ODU0MWI3Ci0tLSAvZGV2L251 bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9qcy9yZWdyZXNzL2FycmF5LXdpdGgtZG91YmxlLWRm Zy1hc3NpZ24uaHRtbApAQCAtMCwwICsxLDEyIEBACis8IURPQ1RZUEUgSFRNTCBQVUJMSUMgIi0v L0lFVEYvL0RURCBIVE1MLy9FTiI+Cis8aHRtbD4KKzxoZWFkPgorPHNjcmlwdCBzcmM9Ii4uL3Jl c291cmNlcy9qcy10ZXN0LXByZS5qcyI+PC9zY3JpcHQ+Cis8L2hlYWQ+Cis8Ym9keT4KKzxzY3Jp cHQgc3JjPSJyZXNvdXJjZXMvcmVncmVzcy1wcmUuanMiPjwvc2NyaXB0PgorPHNjcmlwdCBzcmM9 InNjcmlwdC10ZXN0cy9hcnJheS13aXRoLWRvdWJsZS1kZmctYXNzaWduLmpzIj48L3NjcmlwdD4K KzxzY3JpcHQgc3JjPSJyZXNvdXJjZXMvcmVncmVzcy1wb3N0LmpzIj48L3NjcmlwdD4KKzxzY3Jp cHQgc3JjPSIuLi9yZXNvdXJjZXMvanMtdGVzdC1wb3N0LmpzIj48L3NjcmlwdD4KKzwvYm9keT4K KzwvaHRtbD4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvanMvcmVncmVzcy9hcnJheS13 aXRoLWRvdWJsZS1kZmctcHVzaC1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9mYXN0L2pzL3Jl Z3Jlc3MvYXJyYXktd2l0aC1kb3VibGUtZGZnLXB1c2gtZXhwZWN0ZWQudHh0Cm5ldyBmaWxlIG1v ZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLjc2M2VjNTYKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlv dXRUZXN0cy9mYXN0L2pzL3JlZ3Jlc3MvYXJyYXktd2l0aC1kb3VibGUtZGZnLXB1c2gtZXhwZWN0 ZWQudHh0CkBAIC0wLDAgKzEsMTAgQEAKK0pTUmVncmVzcy9hcnJheS13aXRoLWRvdWJsZS1kZmct cHVzaAorCitPbiBzdWNjZXNzLCB5b3Ugd2lsbCBzZWUgYSBzZXJpZXMgb2YgIlBBU1MiIG1lc3Nh Z2VzLCBmb2xsb3dlZCBieSAiVEVTVCBDT01QTEVURSIuCisKKworUEFTUyBubyBleGNlcHRpb24g dGhyb3duCitQQVNTIHN1Y2Nlc3NmdWxseVBhcnNlZCBpcyB0cnVlCisKK1RFU1QgQ09NUExFVEUK KwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9qcy9yZWdyZXNzL2FycmF5LXdpdGgtZG91 YmxlLWRmZy1wdXNoLmh0bWwgYi9MYXlvdXRUZXN0cy9mYXN0L2pzL3JlZ3Jlc3MvYXJyYXktd2l0 aC1kb3VibGUtZGZnLXB1c2guaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAw Li4xN2Q0ZjYxCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9qcy9yZWdyZXNz L2FycmF5LXdpdGgtZG91YmxlLWRmZy1wdXNoLmh0bWwKQEAgLTAsMCArMSwxMiBAQAorPCFET0NU WVBFIEhUTUwgUFVCTElDICItLy9JRVRGLy9EVEQgSFRNTC8vRU4iPgorPGh0bWw+Cis8aGVhZD4K KzxzY3JpcHQgc3JjPSIuLi9yZXNvdXJjZXMvanMtdGVzdC1wcmUuanMiPjwvc2NyaXB0PgorPC9o ZWFkPgorPGJvZHk+Cis8c2NyaXB0IHNyYz0icmVzb3VyY2VzL3JlZ3Jlc3MtcHJlLmpzIj48L3Nj cmlwdD4KKzxzY3JpcHQgc3JjPSJzY3JpcHQtdGVzdHMvYXJyYXktd2l0aC1kb3VibGUtZGZnLXB1 c2guanMiPjwvc2NyaXB0PgorPHNjcmlwdCBzcmM9InJlc291cmNlcy9yZWdyZXNzLXBvc3QuanMi Pjwvc2NyaXB0PgorPHNjcmlwdCBzcmM9Ii4uL3Jlc291cmNlcy9qcy10ZXN0LXBvc3QuanMiPjwv c2NyaXB0PgorPC9ib2R5PgorPC9odG1sPgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9q cy9yZWdyZXNzL3NjcmlwdC10ZXN0cy9hcnJheS13aXRoLWRvdWJsZS1kZmctYXNzaWduLmpzIGIv TGF5b3V0VGVzdHMvZmFzdC9qcy9yZWdyZXNzL3NjcmlwdC10ZXN0cy9hcnJheS13aXRoLWRvdWJs ZS1kZmctYXNzaWduLmpzCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLjk4MjJh OGEKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2pzL3JlZ3Jlc3Mvc2NyaXB0 LXRlc3RzL2FycmF5LXdpdGgtZG91YmxlLWRmZy1hc3NpZ24uanMKQEAgLTAsMCArMSwxOSBAQAor ZnVuY3Rpb24gZm9vKG4pIHsKKyAgdmFyIGk7CisgIHZhciBzdW0gPSAwOworICB2YXIgYSA9IG5l dyBBcnJheSgpOworICBmb3IgKGkgPSAwOyBpIDwgbjsgaSsrKQorICAgIGFbaV0gPSBpICsgMC41 OworICBmb3IgKGkgPSAwOyBpIDwgbjsgaSsrKQorICAgIHN1bSArPSBhW2ldOworICByZXR1cm4g KHN1bSAhPSAobiAvIDIgKyBuICogKG4gLSAxKSAvIDIpKTsKK30KKworZnVuY3Rpb24gbWFpbigp IHsKKyAgdmFyIGk7CisgIGZvciAoaSA9IDA7IGkgPCAxMDA7IGkrKykKKyAgICBpZiAoZm9vKGkp KQorICAgICAgdGhyb3coIkVSUk9SIik7Cit9CisKK21haW4oKTsKZGlmZiAtLWdpdCBhL0xheW91 dFRlc3RzL2Zhc3QvanMvcmVncmVzcy9zY3JpcHQtdGVzdHMvYXJyYXktd2l0aC1kb3VibGUtZGZn LXB1c2guanMgYi9MYXlvdXRUZXN0cy9mYXN0L2pzL3JlZ3Jlc3Mvc2NyaXB0LXRlc3RzL2FycmF5 LXdpdGgtZG91YmxlLWRmZy1wdXNoLmpzCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAw MDAuLmE3MDU0NWIKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2pzL3JlZ3Jl c3Mvc2NyaXB0LXRlc3RzL2FycmF5LXdpdGgtZG91YmxlLWRmZy1wdXNoLmpzCkBAIC0wLDAgKzEs MTkgQEAKK2Z1bmN0aW9uIGZvbyhuKSB7CisgIHZhciBpOworICB2YXIgc3VtID0gMDsKKyAgdmFy IGEgPSBuZXcgQXJyYXkoKTsKKyAgZm9yIChpID0gMDsgaSA8IG47IGkrKykKKyAgICBhLnB1c2go aSArIDAuNSk7CisgIGZvciAoaSA9IDA7IGkgPCBuOyBpKyspCisgICAgc3VtICs9IGFbaV07Cisg IHJldHVybiAoc3VtICE9IChuIC8gMiArIG4gKiAobiAtIDEpIC8gMikpOworfQorCitmdW5jdGlv biBtYWluKCkgeworICB2YXIgaTsKKyAgZm9yIChpID0gMDsgaSA8IDUwOyBpKyspCisgICAgaWYg KGZvbyhpKSkKKyAgICAgIHRocm93KCJFUlJPUiIpOworfQorCittYWluKCk7CmRpZmYgLS1naXQg YS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3Jl L0NoYW5nZUxvZwppbmRleCBlOThhMjlhLi40YzFkOWNjIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2 YVNjcmlwdENvcmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VM b2cKQEAgLTEsMyArMSwxNyBAQAorMjAxMy0wNS0xNyAgUm9tYW4gWmh1eWtvdiAgPHpocm9tYUBp c3ByYXMucnU+CisKKyAgICAgICAgRml4IGZvciBjYWxsaW5nIERGR19PUEVSQVRJT05zIHdpdGgg ZG91YmxlIGFyZ3VtZW50cyBvbiBBUk0gc29mdC1mcC4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndl YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTExNjMxNQorCisgICAgICAgIFJldmlld2VkIGJ5IE5P Qk9EWSAoT09QUyEpLgorCisgICAgICAgIEZpeCBzZXR1cEFyZ3VtZW50c1dpdGhFeGVjU3RhdGUg Zm9yIEFSTSBzb2Z0LWZwIGNhc2UKKyAgICAgICAgdG8gd29yayBpbiBhIHByb3BlciB3YXkgd2l0 aCBkb3VibGUgYXJndW1lbnRzLgorICAgICAgICBBbGwgYXJndW1lbnRzIGZvciBERkdfT1BFUkFU SU9OcyBhcmUgcGxhY2VkIGNvcnJlY2x0eS4KKworICAgICAgICAqIGRmZy9ERkdDQ2FsbEhlbHBl cnMuaDoKKyAgICAgICAgKEpTQzo6REZHOjpDQ2FsbEhlbHBlcnM6OnNldHVwQXJndW1lbnRzV2l0 aEV4ZWNTdGF0ZSk6CisKIDIwMTMtMDUtMTYgIFBhdHJpY2sgR2Fuc3RlcmVyICA8cGFyb2dhQHdl YmtpdC5vcmc+CiAKICAgICAgICAgQ29uc29saWRhdGUgbGlzdHMgaW4gSmF2YVNjcmlwdENvcmUg Q01ha2UgZmlsZXMKZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHQ0Nh bGxIZWxwZXJzLmggYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0NDYWxsSGVscGVycy5o CmluZGV4IDA2MzExNDkuLmJjYzg0OWEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29y ZS9kZmcvREZHQ0NhbGxIZWxwZXJzLmgKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9E RkdDQ2FsbEhlbHBlcnMuaApAQCAtNTYzLDE3ICs1NjMsMTkgQEAgcHVibGljOgogCiAgICAgQUxX QVlTX0lOTElORSB2b2lkIHNldHVwQXJndW1lbnRzV2l0aEV4ZWNTdGF0ZShGUFJSZWcgYXJnMSwg R1BSUmVnIGFyZzIpCiAgICAgewotICAgICAgICBtb3ZlKGFyZzIsIEdQUkluZm86OmFyZ3VtZW50 R1BSMyk7Ci0gICAgICAgIGFzc2VtYmxlcigpLnZtb3YoR1BSSW5mbzo6YXJndW1lbnRHUFIxLCBH UFJJbmZvOjphcmd1bWVudEdQUjIsIGFyZzEpOworICAgICAgICAvLyBTb2Z0ZnAgYWJpIGFsbG93 cyB0byBwbGFjZSBkb3VibGUgYXJndW1lbnQgb24gdHdvIHJlZ2lzdGVycywgYnV0CisgICAgICAg IC8vICJyMCwgcjEiIGFuZCAicjIsIHIzIiBhcmUgb25seSBhbGxvd2VkIHBhaXJzLCB1c2luZyAi cjEsIHIyIiBpcyB3cm9uZy4KKyAgICAgICAgLy8gRXhlY1N0YXRlIGdvZXMgdG8gcjAsIGRvdWJs ZSBnb2VzIHRvIHIyLXIzLCBhbmQgd2UgbXVzdCB1c2Ugc3RhY2sgZm9yIGFyZzIuCisgICAgICAg IHBva2UoYXJnMik7CisgICAgICAgIGFzc2VtYmxlcigpLnZtb3YoR1BSSW5mbzo6YXJndW1lbnRH UFIyLCBHUFJJbmZvOjphcmd1bWVudEdQUjMsIGFyZzEpOwogICAgICAgICBtb3ZlKEdQUkluZm86 OmNhbGxGcmFtZVJlZ2lzdGVyLCBHUFJJbmZvOjphcmd1bWVudEdQUjApOwogICAgIH0KIAogICAg IEFMV0FZU19JTkxJTkUgdm9pZCBzZXR1cEFyZ3VtZW50c1dpdGhFeGVjU3RhdGUoR1BSUmVnIGFy ZzEsIEdQUlJlZyBhcmcyLCBGUFJSZWcgYXJnMykKICAgICB7CisgICAgICAgIHN0b3JlRG91Ymxl KGFyZzMsIEFkZHJlc3Moc3RhY2tQb2ludGVyUmVnaXN0ZXIsIDApKTsKICAgICAgICAgc2V0dXBT dHViQXJndW1lbnRzKGFyZzEsIGFyZzIpOwogICAgICAgICBtb3ZlKEdQUkluZm86OmNhbGxGcmFt ZVJlZ2lzdGVyLCBHUFJJbmZvOjphcmd1bWVudEdQUjApOwotICAgICAgICBhc3NlbWJsZXIoKS52 bW92KEdQUkluZm86OmFyZ3VtZW50R1BSMywgR1BSSW5mbzo6bm9uQXJnR1BSMCwgYXJnMyk7Ci0g ICAgICAgIHBva2UoR1BSSW5mbzo6bm9uQXJnR1BSMCk7CiAgICAgfQogI2VuZGlmIC8vIENQVShB Uk1fSEFSREZQKQogI2VsaWYgQ1BVKE1JUFMpCg==