133394 2014-05-29 17:10:33 -0700 fix arm64 css jit 2014-05-29 17:26:16 -0700 1 1 1 Unclassified WebKit CSS 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 achristensen webkit-unassigned benjamin oldest_to_newest 1012535 0 achristensen 2014-05-29 17:10:33 -0700 The arm64 css jit could use a deallocated argument register to swap the argument registers in, which would generate invalid code. To prevent this, let's use a designated temporary register for now because we have a plentiful supply of registers, then we can do better register organization later. 1012538 1 232273 achristensen 2014-05-29 17:17:14 -0700 Created attachment 232273 Patch 1012539 2 232273 benjamin 2014-05-29 17:20:45 -0700 Comment on attachment 232273 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=232273&action=review > Source/WebCore/cssjit/SelectorCompiler.cpp:904 > + RELEASE_ASSERT(minimumRegisterCountForAttributes <= registerCount); Please make this an assertion instead of a release assert. In this case, we do not risk a security problem if the assert is false. RegisterAllocator ensure we crash if we ever overallocate. 1012540 3 achristensen 2014-05-29 17:26:16 -0700 http://trac.webkit.org/changeset/169479 232273 2014-05-29 17:17:14 -0700 2014-05-29 17:20:44 -0700 Patch bug-133394-20140529171650.patch text/plain 3546 achristensen SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE2OTQ3NikKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBACisyMDE0LTA1LTI5ICBBbGV4IENo cmlzdGVuc2VuICA8YWNocmlzdGVuc2VuQHdlYmtpdC5vcmc+CisKKyAgICAgICAgUHJlcGFyZSBj c3Mgaml0IGZvciBhcm02NCBhbmQgb3RoZXIgYXJjaGl0ZWN0dXJlcy4KKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzMzM5NAorCisgICAgICAgIFJldmll d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogY3Nzaml0L0Z1bmN0aW9uQ2FsbC5o OgorICAgICAgICAoV2ViQ29yZTo6RnVuY3Rpb25DYWxsOjpzd2FwQXJndW1lbnRzKToKKyAgICAg ICAgKiBjc3NqaXQvUmVnaXN0ZXJBbGxvY2F0b3IuaDoKKyAgICAgICAgVXNlIGEgZGVzaWduYXRl ZCB0ZW1wb3JhcnkgcmVnaXN0ZXIgb24gYXJtNjQgdG8gcHJldmVudCB1c2luZyBhIGRlYWxsb2Nh dGVkIGFyZ3VtZW50IHJlZ2lzdGVyIHRvIHN3YXAgYXJndW1lbnQgcmVnaXN0ZXJzIGluLgorICAg ICAgICAqIGNzc2ppdC9TZWxlY3RvckNvbXBpbGVyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlNl bGVjdG9yQ29tcGlsZXI6OlNlbGVjdG9yQ29kZUdlbmVyYXRvcjo6Z2VuZXJhdGVTZWxlY3RvckNo ZWNrZXIpOgorICAgICAgICBBZGRlZCBhc3NlcnRpb24gdG8gbWFrZSBzdXJlIHRoZXJlIGFyZSBl bm91Z2ggcmVnaXN0ZXJzLgorCiAyMDE0LTA1LTI4ICBKb24gSG9uZXljdXR0ICA8amhvbmV5Y3V0 dEBhcHBsZS5jb20+CiAKICAgICAgICAgUm9sbCByMTY4NjY4IGJhY2sgaW4uCkluZGV4OiBTb3Vy Y2UvV2ViQ29yZS9jc3NqaXQvRnVuY3Rpb25DYWxsLmgKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dl YkNvcmUvY3Nzaml0L0Z1bmN0aW9uQ2FsbC5oCShyZXZpc2lvbiAxNjkyOTcpCisrKyBTb3VyY2Uv V2ViQ29yZS9jc3NqaXQvRnVuY3Rpb25DYWxsLmgJKHdvcmtpbmcgY29weSkKQEAgLTg4LDkgKzg4 LDE0IEBAIHByaXZhdGU6CiAgICAgICAgIC8vIHg4NiBjYW4gc3dhcCB3aXRob3V0IGEgdGVtcG9y YXJ5IHJlZ2lzdGVyLiBPbiBvdGhlciBhcmNoaXRlY3R1cmVzLCB3ZSBuZWVkIGFsbG9jYXRlIGEg dGVtcG9yYXJ5IHJlZ2lzdGVyIHRvIHN3aXRjaCB0aGUgdmFsdWVzLgogI2lmIENQVShYODYpIHx8 IENQVShYODZfNjQpCiAgICAgICAgIG1fYXNzZW1ibGVyLnN3YXAoYSwgYik7CisjZWxpZiBDUFUo QVJNNjQpCisgICAgICAgIG1fYXNzZW1ibGVyLm1vdmUoYSwgdGVtcFJlZ2lzdGVyKTsKKyAgICAg ICAgbV9hc3NlbWJsZXIubW92ZShiLCBhKTsKKyAgICAgICAgbV9hc3NlbWJsZXIubW92ZSh0ZW1w UmVnaXN0ZXIsIGIpOwogI2Vsc2UKICAgICAgICAgaWYgKG1fcmVnaXN0ZXJBbGxvY2F0b3IuYXZh aWxhYmxlUmVnaXN0ZXJDb3VudCgpKSB7CiAgICAgICAgICAgICAvLyBVc3VhbGx5IHdlIGNhbiBq dXN0IHVzZSBhIGZyZWUgcmVnaXN0ZXIuCisgICAgICAgICAgICAvLyBGSVhNRTogV2UgbmVlZCB0 byBtYWtlIHN1cmUgdGhhdCB0ZW1wVmFsdWUgaXMgbm90IGEgb3IgYi4KICAgICAgICAgICAgIExv Y2FsUmVnaXN0ZXIgdGVtcFZhbHVlKG1fcmVnaXN0ZXJBbGxvY2F0b3IpOwogICAgICAgICAgICAg bV9hc3NlbWJsZXIubW92ZShhLCB0ZW1wVmFsdWUpOwogICAgICAgICAgICAgbV9hc3NlbWJsZXIu bW92ZShiLCBhKTsKSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2Nzc2ppdC9SZWdpc3RlckFsbG9jYXRv ci5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL2Nzc2ppdC9SZWdpc3RlckFsbG9jYXRv ci5oCShyZXZpc2lvbiAxNjkyOTcpCisrKyBTb3VyY2UvV2ViQ29yZS9jc3NqaXQvUmVnaXN0ZXJB bGxvY2F0b3IuaAkod29ya2luZyBjb3B5KQpAQCAtNTEsMTEgKzUxLDExIEBAIHN0YXRpYyBjb25z dCBKU0M6Ok1hY3JvQXNzZW1ibGVyOjpSZWdpc3QKICAgICBKU0M6OkFSTTY0UmVnaXN0ZXJzOjp4 MTIsCiAgICAgSlNDOjpBUk02NFJlZ2lzdGVyczo6eDEzLAogICAgIEpTQzo6QVJNNjRSZWdpc3Rl cnM6OngxNCwKLSAgICBKU0M6OkFSTTY0UmVnaXN0ZXJzOjp4MTUsCiB9Owogc3RhdGljIGNvbnN0 IEpTQzo6TWFjcm9Bc3NlbWJsZXI6OlJlZ2lzdGVySUQgY2FsbGVlU2F2ZWRSZWdpc3RlcnNbXSA9 IHsKICAgICBKU0M6OkFSTTY0UmVnaXN0ZXJzOjp4MTkKIH07CitzdGF0aWMgY29uc3QgSlNDOjpN YWNyb0Fzc2VtYmxlcjo6UmVnaXN0ZXJJRCB0ZW1wUmVnaXN0ZXIgPSBKU0M6OkFSTTY0UmVnaXN0 ZXJzOjp4MTU7CiAjZWxpZiBDUFUoWDg2XzY0KQogc3RhdGljIGNvbnN0IEpTQzo6TWFjcm9Bc3Nl bWJsZXI6OlJlZ2lzdGVySUQgY2FsbGVyU2F2ZWRSZWdpc3RlcnNbXSA9IHsKICAgICBKU0M6Olg4 NlJlZ2lzdGVyczo6ZWF4LApJbmRleDogU291cmNlL1dlYkNvcmUvY3Nzaml0L1NlbGVjdG9yQ29t cGlsZXIuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL2Nzc2ppdC9TZWxlY3RvckNv bXBpbGVyLmNwcAkocmV2aXNpb24gMTY5Mjk3KQorKysgU291cmNlL1dlYkNvcmUvY3Nzaml0L1Nl bGVjdG9yQ29tcGlsZXIuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC05MDEsNiArOTAxLDcgQEAgdm9p ZCBTZWxlY3RvckNvZGVHZW5lcmF0b3I6OmdlbmVyYXRlU2VsZQogICAgIGJvb2wgcmVzZXJ2ZWRD YWxsZWVTYXZlZFJlZ2lzdGVycyA9IGZhbHNlOwogICAgIHVuc2lnbmVkIGF2YWlsYWJsZVJlZ2lz dGVyQ291bnQgPSBtX3JlZ2lzdGVyQWxsb2NhdG9yLmF2YWlsYWJsZVJlZ2lzdGVyQ291bnQoKTsK ICAgICB1bnNpZ25lZCBtaW5pbXVtUmVnaXN0ZXJDb3VudEZvckF0dHJpYnV0ZXMgPSBtaW5pbXVt UmVnaXN0ZXJSZXF1aXJlbWVudHMobV9zZWxlY3RvckZyYWdtZW50cyk7CisgICAgUkVMRUFTRV9B U1NFUlQobWluaW11bVJlZ2lzdGVyQ291bnRGb3JBdHRyaWJ1dGVzIDw9IHJlZ2lzdGVyQ291bnQp OwogICAgIGlmIChhdmFpbGFibGVSZWdpc3RlckNvdW50IDwgbWluaW11bVJlZ2lzdGVyQ291bnRG b3JBdHRyaWJ1dGVzKSB7CiAgICAgICAgIHJlc2VydmVkQ2FsbGVlU2F2ZWRSZWdpc3RlcnMgPSB0 cnVlOwogICAgICAgICBjYWxsZWVTYXZlZFJlZ2lzdGVyU3RhY2tSZWZlcmVuY2VzID0gbV9zdGFj a0FsbG9jYXRvci5wdXNoKG1fcmVnaXN0ZXJBbGxvY2F0b3IucmVzZXJ2ZUNhbGxlZVNhdmVkUmVn aXN0ZXJzKG1pbmltdW1SZWdpc3RlckNvdW50Rm9yQXR0cmlidXRlcyAtIGF2YWlsYWJsZVJlZ2lz dGVyQ291bnQpKTsK