wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-11-01 03:57:30 +09:00
Code Issues Projects Releases Packages Wiki Activity

Improve graph edge resolution code.

Browse source 
This is a follow-up to ca7ecd37c94e268972697a37eec4e46771c6e6f2 further improving the DiD resolution for CVE-2018-12386.
This commit is contained in:
wolfbeast 2018-10-23 09:44:24 +02:00 • committed by Roy Tam
commit f592b614d0
4 changed files with 48 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

38
js/src/jit/BacktrackingAllocator.cpp
View file

@ -1735,6 +1735,18 @@ BacktrackingAllocator::deadRange(LiveRange* range)
return true;
}
bool
BacktrackingAllocator::moveAtEdge(LBlock* predecessor, LBlock* successor, LiveRange* from,
LiveRange* to, LDefinition::Type type)
{
if (successor->mir()->numPredecessors() > 1) {
MOZ_ASSERT(predecessor->mir()->numSuccessors() == 1);
return moveAtExit(predecessor, from, to, type);
}
return moveAtEntry(successor, from, to, type);
}
bool
BacktrackingAllocator::resolveControlFlow()
{
@ -1846,15 +1858,11 @@ BacktrackingAllocator::resolveControlFlow()
if (!alloc().ensureBallast()) {
return false;
}
if (mSuccessor->numPredecessors() > 1) {
MOZ_ASSERT(predecessor->mir()->numSuccessors() == 1);
if (!moveAtExit(predecessor, from, to, def->type())) {
return false;
}
} else {
if (!moveAtEntry(successor, from, to, def->type())) {
return false;
}
// Note: we have to use moveAtEdge both here and below (for edge
// resolution) to avoid conflicting moves. See bug 1493900.
if (!moveAtEdge(predecessor, successor, from, to, def->type())) {
return false;
}
}
}
@ -1884,16 +1892,12 @@ BacktrackingAllocator::resolveControlFlow()
if (targetRange->covers(exitOf(predecessor)))
continue;
if (!alloc().ensureBallast())
if (!alloc().ensureBallast()) {
return false;
}
LiveRange* from = reg.rangeFor(exitOf(predecessor), true);
if (successor->mir()->numPredecessors() > 1) {
MOZ_ASSERT(predecessor->mir()->numSuccessors() == 1);
if (!moveAtExit(predecessor, from, targetRange, reg.type()))
return false;
} else {
if (!moveAtEntry(successor, from, targetRange, reg.type()))
return false;
if (!moveAtEdge(predecessor, successor, from, targetRange, reg.type())) {
return false;
}
}
}