Commit 1e4b1c52 authored by Jakob Gruber's avatar Jakob Gruber Committed by Commit Bot

[arm] Stricter checks for 24-bit immediates

Several spots in arm codegen require 24-bit integers; since getting
this wrong is usually a security problem, let's change these DCHECKs
into CHECKs.

Bug: chromium:1197363
Change-Id: I277dc8fe4771adae89375adbe19a33d2c9f6783c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2820972
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: 's avatarIgor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73902}
parent 854f704e
...@@ -841,7 +841,7 @@ void Assembler::target_at_put(int pos, int target_pos) { ...@@ -841,7 +841,7 @@ void Assembler::target_at_put(int pos, int target_pos) {
// orr dst, dst, #target8_2 << 16 // orr dst, dst, #target8_2 << 16
uint32_t target24 = target_pos + (Code::kHeaderSize - kHeapObjectTag); uint32_t target24 = target_pos + (Code::kHeaderSize - kHeapObjectTag);
DCHECK(is_uint24(target24)); CHECK(is_uint24(target24));
if (is_uint8(target24)) { if (is_uint8(target24)) {
// If the target fits in a byte then only patch with a mov // If the target fits in a byte then only patch with a mov
// instruction. // instruction.
...@@ -897,7 +897,7 @@ void Assembler::target_at_put(int pos, int target_pos) { ...@@ -897,7 +897,7 @@ void Assembler::target_at_put(int pos, int target_pos) {
instr &= ~kImm24Mask; instr &= ~kImm24Mask;
} }
int imm24 = imm26 >> 2; int imm24 = imm26 >> 2;
DCHECK(is_int24(imm24)); CHECK(is_int24(imm24));
instr_at_put(pos, instr | (imm24 & kImm24Mask)); instr_at_put(pos, instr | (imm24 & kImm24Mask));
} }
...@@ -2258,7 +2258,7 @@ void Assembler::bkpt(uint32_t imm16) { ...@@ -2258,7 +2258,7 @@ void Assembler::bkpt(uint32_t imm16) {
} }
void Assembler::svc(uint32_t imm24, Condition cond) { void Assembler::svc(uint32_t imm24, Condition cond) {
DCHECK(is_uint24(imm24)); CHECK(is_uint24(imm24));
emit(cond | 15 * B24 | imm24); emit(cond | 15 * B24 | imm24);
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment