• zhengxing.li's avatar
    X87: [turbofan] Don't use the CompareIC in JSGenericLowering. · 4a6f1512
    zhengxing.li authored
      port d00da47b(r34335)
    
      original commit message:
      The CompareICStub produces an untagged raw word value, which has to be
      translated to true or false manually in the TurboFan code. But for lazy
      bailout after the CompareIC, we immediately go back to fullcodegen or
      Ignition with the raw value, to a location where both fullcodegen and
      Ignition expect a boolean value, which might crash or in the worst case
      (depending on the exact computation inside the CompareIC) could lead to
      arbitrary memory access.
    
      Short-term fix is to use the proper runtime functions (unified with the
      interpreter now) for comparisons. Next task is to provide optimized
      versions of these based on the CodeStubAssembler, which can then be used
      via code stubs in TurboFan or directly in handlers in the interpreter.
    
    BUG=
    
    Review URL: https://codereview.chromium.org/1744923002
    
    Cr-Commit-Position: refs/heads/master@{#34372}
    4a6f1512
Name
Last commit
Last update
..
OWNERS Loading commit data...
assembler-x87-inl.h Loading commit data...
assembler-x87.cc Loading commit data...
assembler-x87.h Loading commit data...
builtins-x87.cc Loading commit data...
code-stubs-x87.cc Loading commit data...
code-stubs-x87.h Loading commit data...
codegen-x87.cc Loading commit data...
codegen-x87.h Loading commit data...
cpu-x87.cc Loading commit data...
deoptimizer-x87.cc Loading commit data...
disasm-x87.cc Loading commit data...
frames-x87.cc Loading commit data...
frames-x87.h Loading commit data...
interface-descriptors-x87.cc Loading commit data...
macro-assembler-x87.cc Loading commit data...
macro-assembler-x87.h Loading commit data...
simulator-x87.cc Loading commit data...
simulator-x87.h Loading commit data...