853701 - ARM multi-register FP push exposes the stack to corruption

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Douglas Crosher [:dougc]]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:19.0) Gecko/20100101 Firefox/19.0
Build ID: 20130311191316

Steps to reproduce:

Examine the generated ARM Ion machine code.


Actual results:

     sub            sp, sp, #128	;  sp -= 128
     vstmia	       sp!, {d0-d15}   ; sp += 128
;  The data is exposed to corruption on the stack if interrupted here.
     sub            sp, sp, #128	; sp -= 128



Expected results:

     vpush	{d0-d15}

Comment 1

[Douglas Crosher [:dougc]]

Attachment: Propsed patch.

Comment 2

[Luke Wagner [:luke]]

Comment on attachment 727998 [details] [diff] [review]
Propsed patch.

Marty is a looot more familiar with this than I am :)

Comment 3

[Marty Rosenberg [:mjrosenb]]

Nick cameron already has a patch in the pipeline to deal with this.  namely bug 849489.

Comment 4

[Douglas Crosher [:dougc]]

(In reply to Marty Rosenberg [:mjrosenb] from comment #3)
> Nick cameron already has a patch in the pipeline to deal with this.  namely
> bug 849489.

Ok, thanks.  My patch set also includes improvements for pushing
and popping multiple GP registers, and could these be rolled into
the same patch?

Comment 5

[Nick Cameron [:nrc]]

(In reply to Douglas Crosher from comment #4)
> (In reply to Marty Rosenberg [:mjrosenb] from comment #3)
> > Nick cameron already has a patch in the pipeline to deal with this.  namely
> > bug 849489.
> 
> Ok, thanks.  My patch set also includes improvements for pushing
> and popping multiple GP registers, and could these be rolled into
> the same patch?

See Bug 853710, I think we have pretty much the same code, which is reassuring.

Comment 6

[Douglas Crosher [:dougc]]

Resolved by bug 849489 and bug 853710, thank you.