diff options
author | Mike Pall <mike> | 2024-08-15 00:10:01 +0200 |
---|---|---|
committer | Mike Pall <mike> | 2024-08-15 00:10:01 +0200 |
commit | 7369eff67d46d7f5fac9ee064e3fbf97a15458de (patch) | |
tree | c2381ba51f66f3f7d7378fb026489772434ca1b9 | |
parent | 3bdc6498c4c012a8fbf9cfa2756a5b07f56f1540 (diff) | |
download | luajit-7369eff67d46d7f5fac9ee064e3fbf97a15458de.tar.gz luajit-7369eff67d46d7f5fac9ee064e3fbf97a15458de.tar.bz2 luajit-7369eff67d46d7f5fac9ee064e3fbf97a15458de.zip |
Fix IR_ABC hoisting.
Reported by pwnhacker0x18. Fixed by Peter Cawley. #1194
-rw-r--r-- | src/lj_opt_fold.c | 5 | ||||
-rw-r--r-- | src/lj_record.c | 5 |
2 files changed, 6 insertions, 4 deletions
diff --git a/src/lj_opt_fold.c b/src/lj_opt_fold.c index 98ec28c6..622ff0a9 100644 --- a/src/lj_opt_fold.c +++ b/src/lj_opt_fold.c | |||
@@ -1702,9 +1702,10 @@ LJFOLDF(abc_k) | |||
1702 | LJFOLD(ABC any any) | 1702 | LJFOLD(ABC any any) |
1703 | LJFOLDF(abc_invar) | 1703 | LJFOLDF(abc_invar) |
1704 | { | 1704 | { |
1705 | /* Invariant ABC marked as PTR. Drop if op1 is invariant, too. */ | 1705 | /* Invariant ABC marked as P32 or U32. Drop if op1 is invariant too. */ |
1706 | if (!irt_isint(fins->t) && fins->op1 < J->chain[IR_LOOP] && | 1706 | if (!irt_isint(fins->t) && fins->op1 < J->chain[IR_LOOP] && |
1707 | !irt_isphi(IR(fins->op1)->t)) | 1707 | (irt_isu32(fins->t) || |
1708 | (!irref_isk(fins->op1) && !irt_isphi(IR(fins->op1)->t)))) | ||
1708 | return DROPFOLD; | 1709 | return DROPFOLD; |
1709 | return NEXTFOLD; | 1710 | return NEXTFOLD; |
1710 | } | 1711 | } |
diff --git a/src/lj_record.c b/src/lj_record.c index f2a06f41..207327b3 100644 --- a/src/lj_record.c +++ b/src/lj_record.c | |||
@@ -1069,12 +1069,13 @@ static void rec_idx_abc(jit_State *J, TRef asizeref, TRef ikey, uint32_t asize) | |||
1069 | /* Runtime value for stop of loop is within bounds? */ | 1069 | /* Runtime value for stop of loop is within bounds? */ |
1070 | if ((uint64_t)stop + ofs < (uint64_t)asize) { | 1070 | if ((uint64_t)stop + ofs < (uint64_t)asize) { |
1071 | /* Emit invariant bounds check for stop. */ | 1071 | /* Emit invariant bounds check for stop. */ |
1072 | emitir(IRTG(IR_ABC, IRT_P32), asizeref, ofs == 0 ? J->scev.stop : | 1072 | uint32_t abc = IRTG(IR_ABC, tref_isk(asizeref) ? IRT_U32 : IRT_P32); |
1073 | emitir(abc, asizeref, ofs == 0 ? J->scev.stop : | ||
1073 | emitir(IRTI(IR_ADD), J->scev.stop, ofsref)); | 1074 | emitir(IRTI(IR_ADD), J->scev.stop, ofsref)); |
1074 | /* Emit invariant bounds check for start, if not const or negative. */ | 1075 | /* Emit invariant bounds check for start, if not const or negative. */ |
1075 | if (!(J->scev.dir && J->scev.start && | 1076 | if (!(J->scev.dir && J->scev.start && |
1076 | (int64_t)IR(J->scev.start)->i + ofs >= 0)) | 1077 | (int64_t)IR(J->scev.start)->i + ofs >= 0)) |
1077 | emitir(IRTG(IR_ABC, IRT_P32), asizeref, ikey); | 1078 | emitir(abc, asizeref, ikey); |
1078 | return; | 1079 | return; |
1079 | } | 1080 | } |
1080 | } | 1081 | } |