476761 - Verifier exception handling code probably needs to call emitKill()

Status: VERIFIED INVALID

(Tamarin Graveyard :: Virtual Machine, defect, P2)

Description

[Steven Johnson]

See bug https://bugzilla.mozilla.org/show_bug.cgi?id=473247 : the exception-handling part probably needs to call the jit's emitKill() function when OP_kill is encountered, but adding it causes crashes in some JIT configurations (esp. -Ojit). Someone needs to figure out whether the emitKill() is really necessary, and if so, what's broken in the JIT when it's included.

Comment 1

[Jeff Dyer]

It's right as-is; we don’t want to emit any code here, but we want to mark The affected variables as killed so that they are undefined in the catch block.

See also the loop near the bottom of CodegenLIR::emitBlockStart().  This was a fix for a security hole I found looking the code and got Werner's help to code up a test and make a fix.

Ed