-
Seth Brenith authored
Liftoff can currently run out of registers when compiling an atomic compare-exchange instruction. In order to see this crash, the following conditions must be met: - The offset in the instruction doesn't fit in a 12-bit immediate - Either FLAG_untrusted_code_mitigations is false, or trap handlers are enabled, so that AddMemoryMasking decides to do nothing The fix proposed in this CL is just to defer allocation of a temporary register until after CalculateActualAddress has finished, because it might have also needed a temporary register. Change-Id: I28225614dcdbe2bcc9e52208f1e806baac89c5f1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2488840 Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Reviewed-by: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#70687}
e1fff28b
Name |
Last commit
|
Last update |
---|---|---|
.. | ||
benchmarks | ||
cctest | ||
common | ||
debugger | ||
debugging | ||
fuzzer | ||
fuzzilli | ||
inspector | ||
intl | ||
js-perf-test | ||
memory | ||
message | ||
mjsunit | ||
mkgrokdump | ||
mozilla | ||
test262 | ||
torque | ||
unittests | ||
wasm-api-tests | ||
wasm-js | ||
wasm-spec-tests | ||
webkit | ||
BUILD.gn | ||
OWNERS |