Commit c69cb1f6 authored by Junliang Yan's avatar Junliang Yan Committed by Commit Bot

PPC/s390: Check for stack overflow when pushing arguments in JSConstructStubGeneric

Port d0562944

R=mythria@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ib27ea8c66e3fa37d13d0e10553f1caf10c9d527b
Reviewed-on: https://chromium-review.googlesource.com/c/1332107Reviewed-by: 's avatarJoran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#57447}
parent 125d764e
......@@ -162,6 +162,21 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
__ blr();
}
void Generate_StackOverflowCheck(MacroAssembler* masm, Register num_args,
Register scratch, Label* stack_overflow) {
// Check the stack for overflow. We are not trying to catch
// interruptions (e.g. debug break and preemption) here, so the "real stack
// limit" is checked.
__ LoadRoot(scratch, RootIndex::kRealStackLimit);
// Make scratch the space we have left. The stack might already be overflowed
// here which will cause scratch to become negative.
__ sub(scratch, sp, scratch);
// Check if the arguments will overflow the stack.
__ ShiftLeftImm(r0, num_args, Operand(kPointerSizeLog2));
__ cmp(scratch, r0);
__ ble(stack_overflow); // Signed comparison.
}
} // namespace
// The construct stub for ES5 constructor functions and ES6 class constructors.
......@@ -243,11 +258,24 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
// Restore constructor function and argument count.
__ LoadP(r4, MemOperand(fp, ConstructFrameConstants::kConstructorOffset));
__ LoadP(r3, MemOperand(fp, ConstructFrameConstants::kLengthOffset));
__ SmiUntag(r3, SetRC);
__ SmiUntag(r3);
// Set up pointer to last argument.
__ addi(r7, fp, Operand(StandardFrameConstants::kCallerSPOffset));
Label enough_stack_space, stack_overflow;
Generate_StackOverflowCheck(masm, r3, r8, &stack_overflow);
__ b(&enough_stack_space);
__ bind(&stack_overflow);
// Restore the context from the frame.
__ LoadP(cp, MemOperand(fp, ConstructFrameConstants::kContextOffset));
__ CallRuntime(Runtime::kThrowStackOverflow);
// Unreachable code.
__ bkpt(0);
__ bind(&enough_stack_space);
// Copy arguments and receiver to the expression stack.
Label loop, no_args;
// ----------- S t a t e -------------
......@@ -262,7 +290,8 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
// -- sp[4*kPointerSize]: number of arguments (tagged)
// -- sp[5*kPointerSize]: context
// -----------------------------------
__ beq(&no_args, cr0);
__ cmpi(r3, Operand::Zero());
__ beq(&no_args);
__ ShiftLeftImm(ip, r3, Operand(kPointerSizeLog2));
__ sub(sp, sp, ip);
__ mtctr(r3);
......@@ -961,22 +990,6 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
__ blr();
}
static void Generate_StackOverflowCheck(MacroAssembler* masm, Register num_args,
Register scratch,
Label* stack_overflow) {
// Check the stack for overflow. We are not trying to catch
// interruptions (e.g. debug break and preemption) here, so the "real stack
// limit" is checked.
__ LoadRoot(scratch, RootIndex::kRealStackLimit);
// Make scratch the space we have left. The stack might already be overflowed
// here which will cause scratch to become negative.
__ sub(scratch, sp, scratch);
// Check if the arguments will overflow the stack.
__ ShiftLeftImm(r0, num_args, Operand(kPointerSizeLog2));
__ cmp(scratch, r0);
__ ble(stack_overflow); // Signed comparison.
}
static void Generate_InterpreterPushArgs(MacroAssembler* masm,
Register num_args, Register index,
Register count, Register scratch) {
......
......@@ -156,6 +156,21 @@ void Generate_JSBuiltinsConstructStubHelper(MacroAssembler* masm) {
__ Ret();
}
void Generate_StackOverflowCheck(MacroAssembler* masm, Register num_args,
Register scratch, Label* stack_overflow) {
// Check the stack for overflow. We are not trying to catch
// interruptions (e.g. debug break and preemption) here, so the "real stack
// limit" is checked.
__ LoadRoot(scratch, RootIndex::kRealStackLimit);
// Make scratch the space we have left. The stack might already be overflowed
// here which will cause scratch to become negative.
__ SubP(scratch, sp, scratch);
// Check if the arguments will overflow the stack.
__ ShiftLeftP(r0, num_args, Operand(kPointerSizeLog2));
__ CmpP(scratch, r0);
__ ble(stack_overflow); // Signed comparison.
}
} // namespace
// The construct stub for ES5 constructor functions and ES6 class constructors.
......@@ -242,6 +257,19 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
// Set up pointer to last argument.
__ la(r6, MemOperand(fp, StandardFrameConstants::kCallerSPOffset));
Label enough_stack_space, stack_overflow;
Generate_StackOverflowCheck(masm, r2, r7, &stack_overflow);
__ b(&enough_stack_space);
__ bind(&stack_overflow);
// Restore the context from the frame.
__ LoadP(cp, MemOperand(fp, ConstructFrameConstants::kContextOffset));
__ CallRuntime(Runtime::kThrowStackOverflow);
// Unreachable code.
__ bkpt(0);
__ bind(&enough_stack_space);
// Copy arguments and receiver to the expression stack.
Label loop, no_args;
// ----------- S t a t e -------------
......@@ -257,6 +285,7 @@ void Builtins::Generate_JSConstructStubGeneric(MacroAssembler* masm) {
// -- sp[5*kPointerSize]: context
// -----------------------------------
__ ltgr(r2, r2);
__ beq(&no_args);
__ ShiftLeftP(ip, r2, Operand(kPointerSizeLog2));
__ SubP(sp, sp, ip);
......@@ -966,22 +995,6 @@ void Builtins::Generate_InterpreterEntryTrampoline(MacroAssembler* masm) {
__ Ret();
}
static void Generate_StackOverflowCheck(MacroAssembler* masm, Register num_args,
Register scratch,
Label* stack_overflow) {
// Check the stack for overflow. We are not trying to catch
// interruptions (e.g. debug break and preemption) here, so the "real stack
// limit" is checked.
__ LoadRoot(scratch, RootIndex::kRealStackLimit);
// Make scratch the space we have left. The stack might already be overflowed
// here which will cause scratch to become negative.
__ SubP(scratch, sp, scratch);
// Check if the arguments will overflow the stack.
__ ShiftLeftP(r0, num_args, Operand(kPointerSizeLog2));
__ CmpP(scratch, r0);
__ ble(stack_overflow); // Signed comparison.
}
static void Generate_InterpreterPushArgs(MacroAssembler* masm,
Register num_args, Register index,
Register count, Register scratch) {
......
......@@ -7,7 +7,7 @@
#include "src/assembler-inl.h"
#include "src/callable.h"
#include "src/compiler/backend/gap-resolver.h"
#include "src/compiler/code-generator-impl.h"
#include "src/compiler/backend/code-generator-impl.h"
#include "src/compiler/node-matchers.h"
#include "src/compiler/osr.h"
#include "src/optimized-compilation-info.h"
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment