From 416abff90dae9c66e17efe9d6a01efce63eefba8 Mon Sep 17 00:00:00 2001
From: Mike Pall <mike>
Date: Thu, 6 Mar 2014 00:39:37 +0100
Subject: Don't access dangling reference to reallocated IR.
---
src/lj_asm.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/src/lj_asm.c b/src/lj_asm.c
index 3f472d28..264649ae 100644
--- a/src/lj_asm.c
+++ b/src/lj_asm.c
@@ -1246,16 +1246,18 @@ static void asm_phi_fixup(ASMState *as)
Reg r = rset_picktop(work);
IRRef lref = as->phireg[r];
IRIns *ir = IR(lref);
- /* Left PHI gained a spill slot before the loop? */
- if (irt_ismarked(ir->t) && ra_hasspill(ir->s)) {
- IRRef ren;
- lj_ir_set(as->J, IRT(IR_RENAME, IRT_NIL), lref, as->loopsnapno);
- ren = tref_ref(lj_ir_emit(as->J));
- as->ir = as->T->ir; /* The IR may have been reallocated. */
- IR(ren)->r = (uint8_t)r;
- IR(ren)->s = SPS_NONE;
+ if (irt_ismarked(ir->t)) {
+ irt_clearmark(ir->t);
+ /* Left PHI gained a spill slot before the loop? */
+ if (ra_hasspill(ir->s)) {
+ IRRef ren;
+ lj_ir_set(as->J, IRT(IR_RENAME, IRT_NIL), lref, as->loopsnapno);
+ ren = tref_ref(lj_ir_emit(as->J));
+ as->ir = as->T->ir; /* The IR may have been reallocated. */
+ IR(ren)->r = (uint8_t)r;
+ IR(ren)->s = SPS_NONE;
+ }
}
- irt_clearmark(ir->t); /* Always clear marker. */
rset_clear(work, r);
}
}
--
cgit v1.2.3-55-g6feb