Closed
Bug 813671
Opened 13 years ago
Closed 13 years ago
IonMonkey: ModI can clobber input register
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla20
People
(Reporter: bhackett1024, Assigned: bhackett1024)
References
Details
Attachments
(1 file, 1 obsolete file)
|
2.56 KB,
patch
|
jandem
:
review+
|
Details | Diff | Splinter Review |
On x86/x64, ModI overwrites both eax and edx, but only the latter is marked as an output. The former is a fixed input, and if that input is used anywhere in the instruction's snapshot then the interpreter stack reconstructed on a bailout may be incorrect. This isn't a problem for LSRA as it treats the fixed input like a mutable temporary, but this is really a detail of that allocator rather than a general property which should hold of all allocators.
|
Assignee | |
Comment 1•13 years ago
|
||
Fix. This affects the backtracking allocator (bug 814966) as well.
Assignee: general → bhackett1024
Attachment #691567 -
Flags: review?(jdemooij)
|
|
Assignee | |
Comment 2•13 years ago
|
||
Oops
Attachment #691567 -
Attachment is obsolete: true
Attachment #691567 -
Flags: review?(jdemooij)
Attachment #691655 -
Flags: review?(jdemooij)
|
||
Updated•13 years ago
|
Attachment #691655 -
Flags: review?(jdemooij) → review+
|
|
Assignee | |
Comment 3•13 years ago
|
||
|
||
Comment 4•13 years ago
|
||
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla20
You need to log in
before you can comment on or make changes to this bug.
Description
•