gh-mirror/mikepaul-LuaJIT
1
0
Fork 0
mirror of https://github.com/LuaJIT/LuaJIT.git synced 2025-02-07 15:14:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix IR_ABC hoisting.

Browse Source 
Reported by pwnhacker0x18. Fixed by Peter Cawley. #1194
This commit is contained in:
Mike Pall 2024-08-15 00:10:01 +02:00
parent 3bdc6498c4
commit 7369eff67d
2 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/lj_opt_fold.c
View File

@ -1702,9 +1702,10 @@ LJFOLDF(abc_k)
LJFOLD(ABC any any) LJFOLD(ABC any any)
LJFOLDF(abc_invar) LJFOLDF(abc_invar)
{ {
/* Invariant ABC marked as PTR. Drop if op1 is invariant, too. */ /* Invariant ABC marked as P32 or U32. Drop if op1 is invariant too. */
if (!irt_isint(fins->t) && fins->op1 < J->chain[IR_LOOP] && if (!irt_isint(fins->t) && fins->op1 < J->chain[IR_LOOP] &&
!irt_isphi(IR(fins->op1)->t)) (irt_isu32(fins->t) ||
(!irref_isk(fins->op1) && !irt_isphi(IR(fins->op1)->t))))
return DROPFOLD; return DROPFOLD;
return NEXTFOLD; return NEXTFOLD;
} }

5
src/lj_record.c
View File

@ -1069,12 +1069,13 @@ static void rec_idx_abc(jit_State *J, TRef asizeref, TRef ikey, uint32_t asize)
/* Runtime value for stop of loop is within bounds? */ /* Runtime value for stop of loop is within bounds? */
if ((uint64_t)stop + ofs < (uint64_t)asize) { if ((uint64_t)stop + ofs < (uint64_t)asize) {
/* Emit invariant bounds check for stop. */ /* Emit invariant bounds check for stop. */
emitir(IRTG(IR_ABC, IRT_P32), asizeref, ofs == 0 ? J->scev.stop : uint32_t abc = IRTG(IR_ABC, tref_isk(asizeref) ? IRT_U32 : IRT_P32);
emitir(abc, asizeref, ofs == 0 ? J->scev.stop :
emitir(IRTI(IR_ADD), J->scev.stop, ofsref)); emitir(IRTI(IR_ADD), J->scev.stop, ofsref));
/* Emit invariant bounds check for start, if not const or negative. */ /* Emit invariant bounds check for start, if not const or negative. */
if (!(J->scev.dir && J->scev.start && if (!(J->scev.dir && J->scev.start &&
(int64_t)IR(J->scev.start)->i + ofs >= 0)) (int64_t)IR(J->scev.start)->i + ofs >= 0))
emitir(IRTG(IR_ABC, IRT_P32), asizeref, ikey); emitir(abc, asizeref, ikey);
return; return;
} }
} }