gnu/packages/patches/icecat-CVE-2015-0836-pt-11.patch

   1 From 3f0f685829445ae82974d61f6017fdb67349c32b Mon Sep 17 00:00:00 2001
   2 From: Dan Gohman <sunfish@mozilla.com>
   3 Date: Fri, 9 Jan 2015 09:04:12 -0500
   4 Subject: [PATCH] Bug 1096138 - IonMonkey: Augment Nops with Mops to avoid
   5  collisions with fixed live ranges. r=jandem, a=sledru
   6
   7 ---
   8  js/src/jit/CodeGenerator.cpp |  6 ++++++
   9  js/src/jit/CodeGenerator.h   |  1 +
  10  js/src/jit/LIR-Common.h      |  6 ++++++
  11  js/src/jit/LOpcodes.h        |  1 +
  12  js/src/jit/Lowering.cpp      | 12 ++++++++++++
  13  5 files changed, 26 insertions(+)
  14
  15 diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  16 index 4f07524..ba14f86 100644
  17 --- a/js/src/jit/CodeGenerator.cpp
  18 +++ b/js/src/jit/CodeGenerator.cpp
  19 @@ -1077,6 +1077,12 @@ CodeGenerator::visitNop(LNop *lir)
  20  }
  21
  22  bool
  23 +CodeGenerator::visitMop(LMop *lir)
  24 +{
  25 +    return true;
  26 +}
  27 +
  28 +bool
  29  CodeGenerator::visitOsiPoint(LOsiPoint *lir)
  30  {
  31      // Note: markOsiPoint ensures enough space exists between the last
  32 diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
  33 index 03677a5..dce095d 100644
  34 --- a/js/src/jit/CodeGenerator.h
  35 +++ b/js/src/jit/CodeGenerator.h
  36 @@ -58,6 +58,7 @@ class CodeGenerator : public CodeGeneratorSpecific
  37
  38      bool visitLabel(LLabel *lir);
  39      bool visitNop(LNop *lir);
  40 +    bool visitMop(LMop *lir);
  41      bool visitOsiPoint(LOsiPoint *lir);
  42      bool visitGoto(LGoto *lir);
  43      bool visitTableSwitch(LTableSwitch *ins);
  44 diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
  45 index c90aef9..e7a0e4c 100644
  46 --- a/js/src/jit/LIR-Common.h
  47 +++ b/js/src/jit/LIR-Common.h
  48 @@ -42,6 +42,12 @@ class LNop : public LInstructionHelper<0, 0, 0>
  49      LIR_HEADER(Nop)
  50  };
  51
  52 +class LMop : public LInstructionHelper<0, 0, 0>
  53 +{
  54 +  public:
  55 +    LIR_HEADER(Mop)
  56 +};
  57 +
  58  // An LOsiPoint captures a snapshot after a call and ensures enough space to
  59  // patch in a call to the invalidation mechanism.
  60  //
  61 diff --git a/js/src/jit/LOpcodes.h b/js/src/jit/LOpcodes.h
  62 index a32d64f..cd7eef8 100644
  63 --- a/js/src/jit/LOpcodes.h
  64 +++ b/js/src/jit/LOpcodes.h
  65 @@ -10,6 +10,7 @@
  66  #define LIR_COMMON_OPCODE_LIST(_)   \
  67      _(Label)                        \
  68      _(Nop)                          \
  69 +    _(Mop)                          \
  70      _(OsiPoint)                     \
  71      _(MoveGroup)                    \
  72      _(Integer)                      \
  73 diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
  74 index d5f8227..48b7fa9 100644
  75 --- a/js/src/jit/Lowering.cpp
  76 +++ b/js/src/jit/Lowering.cpp
  77 @@ -3616,12 +3616,24 @@ LIRGenerator::visitInstruction(MInstruction *ins)
  78      ins->setInWorklistUnchecked();
  79  #endif
  80
  81 +    // If we added a Nop for this instruction, we'll also add a Mop, so that
  82 +    // that live-ranges for fixed register defs, which with LSRA extend through
  83 +    // the Nop so that they can extend through the OsiPoint don't, with their
  84 +    // one-extra extension, extend into a position where they use the input
  85 +    // move group for the following instruction.
  86 +    bool needsMop = !current->instructions().empty() && current->rbegin()->isNop();
  87 +
  88      // If no safepoint was created, there's no need for an OSI point.
  89      if (LOsiPoint *osiPoint = popOsiPoint()) {
  90          if (!add(osiPoint))
  91              return false;
  92      }
  93
  94 +    if (needsMop) {
  95 +        if (!add(new(alloc()) LMop))
  96 +            return false;
  97 +    }
  98 +
  99      return true;
 100  }
 101
 102 --
 103 2.2.1
 104