Skip to content

Commit 7d8e279

Browse files
bjaideepCommit bot
bjaideep
authored and
Commit bot
committed
PPC: [regexp] do not assume short external strings have a minimum size.
Port 3518e49 Original commit message: Short external strings do not cache the resource data, and may be used for compressible strings. The assumptions about their lengths is invalid and may lead to oob reads. [email protected], [email protected], [email protected], [email protected], [email protected] BUG=v8:4923,chromium:604897 LOG=N Review URL: https://codereview.chromium.org/1901593005 Cr-Commit-Position: refs/heads/master@{#35671}
1 parent 921381b commit 7d8e279

1 file changed

Lines changed: 29 additions & 39 deletions

File tree

‎src/ppc/code-stubs-ppc.cc‎

Lines changed: 29 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1639,69 +1639,59 @@ void RegExpExecStub::Generate(MacroAssembler* masm) {
16391639
__ LoadP(subject, MemOperand(sp, kSubjectOffset));
16401640
__ JumpIfSmi(subject, &runtime);
16411641
__ mr(r6, subject); // Make a copy of the original subject string.
1642-
__ LoadP(r3, FieldMemOperand(subject, HeapObject::kMapOffset));
1643-
__ lbz(r3, FieldMemOperand(r3, Map::kInstanceTypeOffset));
16441642
// subject: subject string
16451643
// r6: subject string
1646-
// r3: subject string instance type
16471644
// regexp_data: RegExp data (FixedArray)
16481645
// Handle subject string according to its encoding and representation:
1649-
// (1) Sequential string? If yes, go to (5).
1650-
// (2) Anything but sequential or cons? If yes, go to (6).
1651-
// (3) Cons string. If the string is flat, replace subject with first string.
1652-
// Otherwise bailout.
1653-
// (4) Is subject external? If yes, go to (7).
1654-
// (5) Sequential string. Load regexp code according to encoding.
1646+
// (1) Sequential string? If yes, go to (4).
1647+
// (2) Sequential or cons? If not, go to (5).
1648+
// (3) Cons string. If the string is flat, replace subject with first string
1649+
// and go to (1). Otherwise bail out to runtime.
1650+
// (4) Sequential string. Load regexp code according to encoding.
16551651
// (E) Carry on.
16561652
/// [...]
16571653

16581654
// Deferred code at the end of the stub:
1659-
// (6) Not a long external string? If yes, go to (8).
1660-
// (7) External string. Make it, offset-wise, look like a sequential string.
1661-
// Go to (5).
1662-
// (8) Short external string or not a string? If yes, bail out to runtime.
1663-
// (9) Sliced string. Replace subject with parent. Go to (4).
1655+
// (5) Long external string? If not, go to (7).
1656+
// (6) External string. Make it, offset-wise, look like a sequential string.
1657+
// Go to (4).
1658+
// (7) Short external string or not a string? If yes, bail out to runtime.
1659+
// (8) Sliced string. Replace subject with parent. Go to (1).
1660+
1661+
Label seq_string /* 4 */, external_string /* 6 */, check_underlying /* 1 */,
1662+
not_seq_nor_cons /* 5 */, not_long_external /* 7 */;
16641663

1665-
Label seq_string /* 5 */, external_string /* 7 */, check_underlying /* 4 */,
1666-
not_seq_nor_cons /* 6 */, not_long_external /* 8 */;
1664+
__ bind(&check_underlying);
1665+
__ LoadP(r3, FieldMemOperand(subject, HeapObject::kMapOffset));
1666+
__ lbz(r3, FieldMemOperand(r3, Map::kInstanceTypeOffset));
1667+
1668+
// (1) Sequential string? If yes, go to (4).
16671669

1668-
// (1) Sequential string? If yes, go to (5).
16691670
STATIC_ASSERT((kIsNotStringMask | kStringRepresentationMask |
16701671
kShortExternalStringMask) == 0x93);
16711672
__ andi(r4, r3, Operand(kIsNotStringMask | kStringRepresentationMask |
16721673
kShortExternalStringMask));
16731674
STATIC_ASSERT((kStringTag | kSeqStringTag) == 0);
1674-
__ beq(&seq_string, cr0); // Go to (5).
1675+
__ beq(&seq_string, cr0); // Go to (4).
16751676

1676-
// (2) Anything but sequential or cons? If yes, go to (6).
1677+
// (2) Sequential or cons? If not, go to (5).
16771678
STATIC_ASSERT(kConsStringTag < kExternalStringTag);
16781679
STATIC_ASSERT(kSlicedStringTag > kExternalStringTag);
16791680
STATIC_ASSERT(kIsNotStringMask > kExternalStringTag);
16801681
STATIC_ASSERT(kShortExternalStringTag > kExternalStringTag);
16811682
STATIC_ASSERT(kExternalStringTag < 0xffffu);
16821683
__ cmpi(r4, Operand(kExternalStringTag));
1683-
__ bge(&not_seq_nor_cons); // Go to (6).
1684+
__ bge(&not_seq_nor_cons); // Go to (5).
16841685

16851686
// (3) Cons string. Check that it's flat.
16861687
// Replace subject with first string and reload instance type.
16871688
__ LoadP(r3, FieldMemOperand(subject, ConsString::kSecondOffset));
16881689
__ CompareRoot(r3, Heap::kempty_stringRootIndex);
16891690
__ bne(&runtime);
16901691
__ LoadP(subject, FieldMemOperand(subject, ConsString::kFirstOffset));
1692+
__ b(&check_underlying);
16911693

1692-
// (4) Is subject external? If yes, go to (7).
1693-
__ bind(&check_underlying);
1694-
__ LoadP(r3, FieldMemOperand(subject, HeapObject::kMapOffset));
1695-
__ lbz(r3, FieldMemOperand(r3, Map::kInstanceTypeOffset));
1696-
STATIC_ASSERT(kSeqStringTag == 0);
1697-
STATIC_ASSERT(kStringRepresentationMask == 3);
1698-
__ andi(r0, r3, Operand(kStringRepresentationMask));
1699-
// The underlying external string is never a short external string.
1700-
STATIC_ASSERT(ExternalString::kMaxShortLength < ConsString::kMinLength);
1701-
STATIC_ASSERT(ExternalString::kMaxShortLength < SlicedString::kMinLength);
1702-
__ bne(&external_string, cr0); // Go to (7).
1703-
1704-
// (5) Sequential string. Load regexp code according to encoding.
1694+
// (4) Sequential string. Load regexp code according to encoding.
17051695
__ bind(&seq_string);
17061696
// subject: sequential subject string (or look-alike, external string)
17071697
// r6: original subject string
@@ -1934,12 +1924,12 @@ void RegExpExecStub::Generate(MacroAssembler* masm) {
19341924
__ TailCallRuntime(Runtime::kRegExpExec);
19351925

19361926
// Deferred code for string handling.
1937-
// (6) Not a long external string? If yes, go to (8).
1927+
// (5) Long external string? If not, go to (7).
19381928
__ bind(&not_seq_nor_cons);
19391929
// Compare flags are still set.
1940-
__ bgt(&not_long_external); // Go to (8).
1930+
__ bgt(&not_long_external); // Go to (7).
19411931

1942-
// (7) External string. Make it, offset-wise, look like a sequential string.
1932+
// (6) External string. Make it, offset-wise, look like a sequential string.
19431933
__ bind(&external_string);
19441934
__ LoadP(r3, FieldMemOperand(subject, HeapObject::kMapOffset));
19451935
__ lbz(r3, FieldMemOperand(r3, Map::kInstanceTypeOffset));
@@ -1956,15 +1946,15 @@ void RegExpExecStub::Generate(MacroAssembler* masm) {
19561946
STATIC_ASSERT(SeqTwoByteString::kHeaderSize == SeqOneByteString::kHeaderSize);
19571947
__ subi(subject, subject,
19581948
Operand(SeqTwoByteString::kHeaderSize - kHeapObjectTag));
1959-
__ b(&seq_string); // Go to (5).
1949+
__ b(&seq_string); // Go to (4).
19601950

1961-
// (8) Short external string or not a string? If yes, bail out to runtime.
1951+
// (7) Short external string or not a string? If yes, bail out to runtime.
19621952
__ bind(&not_long_external);
19631953
STATIC_ASSERT(kNotStringTag != 0 && kShortExternalStringTag != 0);
19641954
__ andi(r0, r4, Operand(kIsNotStringMask | kShortExternalStringMask));
19651955
__ bne(&runtime, cr0);
19661956

1967-
// (9) Sliced string. Replace subject with parent. Go to (4).
1957+
// (8) Sliced string. Replace subject with parent. Go to (4).
19681958
// Load offset into r11 and replace subject string with parent.
19691959
__ LoadP(r11, FieldMemOperand(subject, SlicedString::kOffsetOffset));
19701960
__ SmiUntag(r11);

0 commit comments

Comments
 (0)