Bug 90669 - Fix loadRGBA8AsFloat to work with older GCC as well
Summary: Fix loadRGBA8AsFloat to work with older GCC as well
Status: RESOLVED DUPLICATE of bug 92797
Alias: None
Product: WebKit
Classification: Unclassified
Component: SVG (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
Depends on:
Reported: 2012-07-06 02:33 PDT by Gabor Rapcsanyi
Modified: 2014-02-13 14:44 PST (History)
3 users (show)

See Also:

proposed patch (3.90 KB, patch)
2012-07-06 05:48 PDT, Gabor Rapcsanyi
no flags Details | Formatted Diff | Diff
patch2 (2.98 KB, patch)
2012-07-06 06:32 PDT, Gabor Rapcsanyi
zherczeg: review-
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Gabor Rapcsanyi 2012-07-06 02:33:53 PDT
Fix loadRGBA8AsFloat to work with older GCC as well
Comment 1 Gabor Rapcsanyi 2012-07-06 05:48:22 PDT
Created attachment 151067 [details]
proposed patch

Fix loadRGBA8AsFloat and set FECompositeArithmeticNEON.h to use NEONHelpers as well.
Comment 2 Gabor Rapcsanyi 2012-07-06 06:32:08 PDT
Created attachment 151075 [details]

The storeFloatAsRGBA8 in NEONHelpers.h different to what FEArithmeticNEON does so I leave that for now.
Comment 3 Zoltan Herczeg 2012-07-06 06:37:48 PDT
Comment on attachment 151075 [details]

Comment 4 Zoltan Herczeg 2012-07-06 06:39:27 PDT
Comment on attachment 151075 [details]

View in context: https://bugs.webkit.org/attachment.cgi?id=151075&action=review

> Source/WebCore/platform/graphics/filters/arm/NEONHelpers.h:40
> -    uint32x2_t temporary1 = vset_lane_u32(*source, temporary1, 0);
> +    uint32x2_t temporary1 = vld1_u32(source);

I think vld1_u32 reads a whole register, which can lead to buffer overflow.
Comment 5 Gabor Rapcsanyi 2012-11-15 05:27:40 PST
Bug fixed with: https://bugs.webkit.org/show_bug.cgi?id=92797

*** This bug has been marked as a duplicate of bug 92797 ***
Comment 6 Daniel Bates 2014-02-13 14:44:31 PST
I extracted the change to use loadRGBA8AsFloat() into the patch for bug #128767.