• Seth Brenith's avatar
    [wasm][arm64] Fix crash on atomic cmpxchg with large offset · e1fff28b
    Seth Brenith authored
    Liftoff can currently run out of registers when compiling an atomic
    compare-exchange instruction. In order to see this crash, the following
    conditions must be met:
    
    - The offset in the instruction doesn't fit in a 12-bit immediate
    - Either FLAG_untrusted_code_mitigations is false, or trap handlers are
      enabled, so that AddMemoryMasking decides to do nothing
    
    The fix proposed in this CL is just to defer allocation of a temporary
    register until after CalculateActualAddress has finished, because it
    might have also needed a temporary register.
    
    Change-Id: I28225614dcdbe2bcc9e52208f1e806baac89c5f1
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2488840
    Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
    Reviewed-by: 's avatarAndreas Haas <ahaas@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#70687}
    e1fff28b
atomics.js 14.9 KB