Commit 70e6298e authored by Leszek Swirski's avatar Leszek Swirski Committed by Commit Bot

[sparkplug] Fix frames during interrupts on x64

The StackGuard in the sparkplug prologue builtin on x64 was called with
the frame in a weird state; in particular, the baseline code PC wasn't
on the stack. This could lead to oddities like the baseline code getting
collected by a GC during the interrupt.

Now we push the baseline code return address and set up a proper frame
for the interrupt.

Bug: v8:11420
Change-Id: I03b4c2f2d204ad413c5f54f9e8fc28182edf9085
Fixed: chromium:1177219
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704658
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: 's avatarToon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72858}
parent a2c31f74
......@@ -1644,8 +1644,6 @@ void Builtins::Generate_BaselineOutOfLinePrologue(MacroAssembler* masm) {
__ incl(
FieldOperand(feedback_vector, FeedbackVector::kInvocationCountOffset));
// Normally r12 is callee saved, but since this isn't a "real" call, we know
// that the baseline code doesn't care about r12, so we can reuse it here.
Register return_address = r12;
__ RecordComment("[ Frame Setup");
......@@ -1714,7 +1712,7 @@ void Builtins::Generate_BaselineOutOfLinePrologue(MacroAssembler* masm) {
// Push the return address back onto the stack for return.
__ PushReturnAddressFrom(return_address);
// Do "fast" return to caller pushed pc.
// Return to caller pushed pc, without any frame teardown.
__ Ret();
__ bind(&has_optimized_code_or_marker);
......@@ -1734,13 +1732,18 @@ void Builtins::Generate_BaselineOutOfLinePrologue(MacroAssembler* masm) {
__ bind(&call_stack_guard);
{
__ RecordComment("[ Stack/interrupt call");
{
// Push the baseline code return address now, as if it had been pushed by
// the call to this builtin.
__ PushReturnAddressFrom(return_address);
FrameScope frame_scope(masm, StackFrame::INTERNAL);
// Save incoming new target or generator
__ Push(kJavaScriptCallNewTargetRegister);
__ CallRuntime(Runtime::kStackGuard, 0);
__ Pop(kJavaScriptCallNewTargetRegister);
}
// Push the return address back onto the stack for return.
__ PushReturnAddressFrom(return_address);
// Return to caller pushed pc, without any frame teardown.
__ Ret();
__ RecordComment("]");
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment