wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-10 10:18:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

1332493- Crash [@ js::wasm::Instance::object]

Browse source 
1332493 - Initialize wasm::DebugFrame before stack overflow check.
This commit is contained in:
win7-7 2025-12-30 03:22:26 +02:00 • committed by wuggy
commit f1fdb383f6
1 changed files with 26 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

47
js/src/wasm/WasmBaselineCompile.cpp
View file

@ -2083,10 +2083,21 @@ class BaseCompiler
maxFramePushed_ = localSize_; maxFramePushed_ = localSize_;
// We won't know until after we've generated code how big the // The TLS pointer is always passed as a hidden argument in WasmTlsReg.
// frame will be (we may need arbitrary spill slots and // Save it into its assigned local slot.
// outgoing param slots) so branch to code emitted after the storeToFramePtr(WasmTlsReg, localInfo_[tlsSlot_].offs());
// function body that will perform the check. if (debugEnabled_) {
// Initialize funcIndex and flag fields of DebugFrame.
size_t debugFrame = masm.framePushed() - DebugFrame::offsetOfFrame();
masm.store32(Imm32(func_.index()),
Address(masm.getStackPointer(), debugFrame + DebugFrame::offsetOfFuncIndex()));
masm.storePtr(ImmWord(0),
Address(masm.getStackPointer(), debugFrame + DebugFrame::offsetOfFlagsWord()));
}
// We won't know until after we've generated code how big the frame will
// be (we may need arbitrary spill slots and outgoing param slots) so
// emit a patchable add that is patched in endFunction().
// //
// Code there will also assume that the fixed-size stack frame // Code there will also assume that the fixed-size stack frame
// has been allocated. // has been allocated.
@ -2121,19 +2132,7 @@ class BaseCompiler
MOZ_CRASH("Function argument type"); MOZ_CRASH("Function argument type");
} }
} }
// The TLS pointer is always passed as a hidden argument in WasmTlsReg.
// Save it into its assigned local slot.
storeToFramePtr(WasmTlsReg, localInfo_[tlsSlot_].offs());
if (debugEnabled_) {
// Initialize funcIndex and flag fields of DebugFrame.
size_t debugFrame = masm.framePushed() - DebugFrame::offsetOfFrame();
masm.store32(Imm32(func_.index()),
Address(masm.getStackPointer(), debugFrame + DebugFrame::offsetOfFuncIndex()));
masm.storePtr(ImmWord(0),
Address(masm.getStackPointer(), debugFrame + DebugFrame::offsetOfFlagsWord()));
}
// Initialize the stack locals to zero. // Initialize the stack locals to zero.
// //
// The following are all Bug 1316820: // The following are all Bug 1316820:
@ -2228,10 +2227,16 @@ class BaseCompiler
// Since we just overflowed the stack, to be on the safe side, pop the // Since we just overflowed the stack, to be on the safe side, pop the
// stack so that, when the trap exit stub executes, it is a safe // stack so that, when the trap exit stub executes, it is a safe
// distance away from the end of the native stack. // distance away from the end of the native stack. If debugEnabled_ is
if (localSize_) // set, we pop all locals space except allocated for DebugFrame to
masm.addToStackPtr(Imm32(localSize_)); // maintain the invariant that, when debugEnabled_, all wasm::Frames
masm.jump(TrapDesc(prologueTrapOffset_, Trap::StackOverflow, /* framePushed = */ 0)); // are valid wasm::DebugFrames which is observable by WasmHandleThrow.
masm.bind(&stackOverflowLabel_);
int32_t debugFrameReserved = debugEnabled_ ? DebugFrame::offsetOfFrame() : 0;
MOZ_ASSERT(localSize_ >= debugFrameReserved);
if (localSize_ > debugFrameReserved)
masm.addToStackPtr(Imm32(localSize_ - debugFrameReserved));
masm.jump(TrapDesc(prologueTrapOffset_, Trap::StackOverflow, debugFrameReserved));
masm.bind(&returnLabel_); masm.bind(&returnLabel_);