aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMike Pall <mike>2024-08-15 00:10:01 +0200
committerMike Pall <mike>2024-08-15 00:10:01 +0200
commit7369eff67d46d7f5fac9ee064e3fbf97a15458de (patch)
treec2381ba51f66f3f7d7378fb026489772434ca1b9
parent3bdc6498c4c012a8fbf9cfa2756a5b07f56f1540 (diff)
downloadluajit-7369eff67d46d7f5fac9ee064e3fbf97a15458de.tar.gz
luajit-7369eff67d46d7f5fac9ee064e3fbf97a15458de.tar.bz2
luajit-7369eff67d46d7f5fac9ee064e3fbf97a15458de.zip
Fix IR_ABC hoisting.
Reported by pwnhacker0x18. Fixed by Peter Cawley. #1194
-rw-r--r--src/lj_opt_fold.c5
-rw-r--r--src/lj_record.c5
2 files changed, 6 insertions, 4 deletions
diff --git a/src/lj_opt_fold.c b/src/lj_opt_fold.c
index 98ec28c6..622ff0a9 100644
--- a/src/lj_opt_fold.c
+++ b/src/lj_opt_fold.c
@@ -1702,9 +1702,10 @@ LJFOLDF(abc_k)
1702LJFOLD(ABC any any) 1702LJFOLD(ABC any any)
1703LJFOLDF(abc_invar) 1703LJFOLDF(abc_invar)
1704{ 1704{
1705 /* Invariant ABC marked as PTR. Drop if op1 is invariant, too. */ 1705 /* Invariant ABC marked as P32 or U32. Drop if op1 is invariant too. */
1706 if (!irt_isint(fins->t) && fins->op1 < J->chain[IR_LOOP] && 1706 if (!irt_isint(fins->t) && fins->op1 < J->chain[IR_LOOP] &&
1707 !irt_isphi(IR(fins->op1)->t)) 1707 (irt_isu32(fins->t) ||
1708 (!irref_isk(fins->op1) && !irt_isphi(IR(fins->op1)->t))))
1708 return DROPFOLD; 1709 return DROPFOLD;
1709 return NEXTFOLD; 1710 return NEXTFOLD;
1710} 1711}
diff --git a/src/lj_record.c b/src/lj_record.c
index f2a06f41..207327b3 100644
--- a/src/lj_record.c
+++ b/src/lj_record.c
@@ -1069,12 +1069,13 @@ static void rec_idx_abc(jit_State *J, TRef asizeref, TRef ikey, uint32_t asize)
1069 /* Runtime value for stop of loop is within bounds? */ 1069 /* Runtime value for stop of loop is within bounds? */
1070 if ((uint64_t)stop + ofs < (uint64_t)asize) { 1070 if ((uint64_t)stop + ofs < (uint64_t)asize) {
1071 /* Emit invariant bounds check for stop. */ 1071 /* Emit invariant bounds check for stop. */
1072 emitir(IRTG(IR_ABC, IRT_P32), asizeref, ofs == 0 ? J->scev.stop : 1072 uint32_t abc = IRTG(IR_ABC, tref_isk(asizeref) ? IRT_U32 : IRT_P32);
1073 emitir(abc, asizeref, ofs == 0 ? J->scev.stop :
1073 emitir(IRTI(IR_ADD), J->scev.stop, ofsref)); 1074 emitir(IRTI(IR_ADD), J->scev.stop, ofsref));
1074 /* Emit invariant bounds check for start, if not const or negative. */ 1075 /* Emit invariant bounds check for start, if not const or negative. */
1075 if (!(J->scev.dir && J->scev.start && 1076 if (!(J->scev.dir && J->scev.start &&
1076 (int64_t)IR(J->scev.start)->i + ofs >= 0)) 1077 (int64_t)IR(J->scev.start)->i + ofs >= 0))
1077 emitir(IRTG(IR_ABC, IRT_P32), asizeref, ikey); 1078 emitir(abc, asizeref, ikey);
1078 return; 1079 return;
1079 } 1080 }
1080 } 1081 }