Bug 152833 – ARMv7 or32(TrustedImm32, AbsoluteAddress) may have a bug with its use of dataTempRegister.

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Mark Lam]

Details in the coming patch.

[Mark Lam]

Created attachment 268457 [details]
proposed fix.

[Mark Lam]

Comment on attachment 268457 [details]
proposed fix.

This patch has passed the JSC tests on ARM64 and ARMv7.  It's ready for a review.

[Mark Lam]

Thanks for the review.  Landed in r194707: <http://trac.webkit.org/r194707>.

[Michael Saboff]

Comment on attachment 268457 [details]
proposed fix.

View in context: https://bugs.webkit.org/attachment.cgi?id=268457&action=review

r-

> Source/JavaScriptCore/assembler/MacroAssemblerARM64.h:548
> +            or32(imm, memoryTempRegister, memoryTempRegister);
> +            store32(memoryTempRegister, address.m_ptr);

You can't store32 with a source of memoryTempRegister as it will be needed to materialize the address.

You could change this to:
    or32(imm, memoryTempRegister, getCachedDataTempRegisterIDAndInvalidate());
    store32(dataTempRegister, address.m_ptr);

Also, please add an ASSERT() to template<int datasize> store() that the src register cannot be memoryTempRegister.

[Mark Lam]

Created attachment 268473 [details]
follow up fix for ARM64.

[Michael Saboff]

Comment on attachment 268473 [details]
follow up fix for ARM64.

r=me

[Mark Lam]

Thanks for the review.  Follow up fix landed in r194711: <http://trac.webkit.org/r194711>.