[Webkit-unassigned] [Bug 148564] New: ScratchRegisterAllocator::preserveReusedRegistersByPushing() should allow room for C helper calls and keep sp properly aligned.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=148564

            Bug ID: 148564
           Summary: ScratchRegisterAllocator::preserveReusedRegistersByPus
                    hing() should allow room for C helper calls and keep
                    sp properly aligned.
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Local Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: mark.lam at apple.com

ScratchRegisterAllocator::preserveReusedRegistersByPushing() pushes registers on the stack in order to preserve them.  But emitPutTransitionStub() which uses preserveReusedRegistersByPushing() may also emit a call to a C helper function to flush the heap write barrier buffer.  The code for emitting C helper calls expects the stack pointer (sp) to already be pointing to a location on the stack where there's adequate space reserved for storing the arguments that the C helper expects, and that space is expected to be at the top of the stack.  Hence, there is a conflict of expectations.  As a result, the arguments for the C helper will overwrite and corrupt the values that are pushed on the stack by preserveReusedRegistersByPushing().

In addition, JIT compiled functions always position the sp such that it will be aligned (according to platform ABI dictates) after a C call is made (i.e. after the frame pointer and return address is pushed on to the stack).  preserveReusedRegistersByPushing()'s arbitrary pushing of a number of saved register values may mess up this alignment.

The fix is to have preserveReusedRegistersByPushing(), after it has pushed the saved register values, adjust the sp to reserve an additional amount of stack space needed for C call helpers plus any padding needed to restore proper sp alignment.  The stack's ReservedZone will ensure that we have enough stack space for this.  ScratchRegisterAllocator::restoreReusedRegistersByPopping() also needs to updated to perform the complement of this behavior.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150828/ffc9f386/attachment.html>