Closed Bug 606063 Opened 14 years ago Closed 14 years ago

JM: Register allocation bug in LSH

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: dvander, Assigned: dvander)

References

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

This is very old code, and somehow didn't hit until I started rewriting the GETELEM path, which was failing deep in v8-crypto. After a few wild goose chases, the problem is that the LSH path does:

   tempRegForData(x)
   copyDataIntoReg(y)

The second allocation can clobber the first.

The attached test case is for an edge condition, I didn't try to test case the actual bug, which only manifested with my patch queue.
Attached patch fixSplinter Review
Attachment #484932 - Flags: review?(dmandelin)
Attachment #484932 - Flags: review?(dmandelin) → review+
http://hg.mozilla.org/mozilla-central/rev/54a03edfa919
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: