LIRGeneratorShared::use allows MIRType::Int64 when INT64_PIECES is 2
Categories
(Core :: JavaScript Engine: JIT, defect, P3)
Tracking
()
Tracking | Status | |
---|---|---|
firefox137 | --- | fixed |
People
(Reporter: anba, Assigned: anba)
References
(Blocks 1 open bug)
Details
Attachments
(2 files)
// It is illegal to call use() on an instruction with two defs.
#if BOX_PIECES > 1
MOZ_ASSERT(mir->type() != MIRType::Value);
#endif
#if INT64_PIECES > 1
MOZ_ASSERT(mir->type() != MIRType::Int64);
#endif
This code incorrectly allows MIRType::Int64
when INT64_PIECES
is 2. (The BOX_PIECES > 1
check works correctly, though.)
Hint: Check how INT64_PIECES
and BOX_PIECES
are defined.
Assignee | ||
Comment 1•15 days ago
|
||
LIRGeneratorShared::use
allowed to allocate a register for the low-word of an
int64 value, because the INT64_PIECES > 1
assertion didn't propery work. (The
assertion was wrapped with #if INT64_PIECES > 1
, but INT64_PIECES
is a C++
constant and not a macro processor #define
, so #if INT64_PIECES > 1
always
evaluated to false
.)
Add LIRGeneratorShared::useLowWord
for 32-bit targets to provide the correct
way to allocate a register for an int64 low-word. And then update the three places
which only worked due to the incorrect assertion:
lowerForShiftInt64
on x86 and arm32.visitWasmWrapU32Index
whenJS_64BIT
is false.visitWasmStore
for x86 when the input is an int64 value.
Assignee | ||
Comment 2•15 days ago
|
||
Align with the x86 code to only use LWasmStoreI64
the input is an Int64 value.
Updated•14 days ago
|
Comment 4•13 days ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/12ba7ff7a874
https://hg.mozilla.org/mozilla-central/rev/636a1a175b01
Description
•