diff options
author | Alon Zakai <azakai@mozilla.com> | 2011-02-04 20:58:35 -0800 |
---|---|---|
committer | Alon Zakai <azakai@mozilla.com> | 2011-02-04 20:58:35 -0800 |
commit | 94db1931556f0476b40d268db641a68e6fa353ee (patch) | |
tree | 62c7a15f15a31136013316a3b9bd3de6a95bc396 /src | |
parent | b6aeefa650fb91865c01d6e0f96b55f94c23cbff (diff) |
unsign in zext to prevent a sign error
Diffstat (limited to 'src')
-rw-r--r-- | src/jsifier.js | 24 | ||||
-rw-r--r-- | src/library.js | 9 |
2 files changed, 23 insertions, 10 deletions
diff --git a/src/jsifier.js b/src/jsifier.js index 9a405f55..edf8c6fa 100644 --- a/src/jsifier.js +++ b/src/jsifier.js @@ -753,6 +753,8 @@ function JSify(data, functionsOnly, givenTypes, givenFunctions, givenGlobalVaria }); function makeSignOp(value, type, op) { + if (!value) return value; + if (!GUARD_SIGNS) return value; if (type in Runtime.INT_TYPES) { var bits = parseInt(type.substr(1)); return op + 'Sign(' + value + ', ' + bits + ')'; @@ -772,16 +774,16 @@ function JSify(data, functionsOnly, givenTypes, givenFunctions, givenGlobalVaria for (var i = 1; i <= 4; i++) { if (item['param'+i]) { item['ident'+i] = indexizeFunctions(finalizeLLVMParameter(item['param'+i])); + } else { + item['ident'+i] = null; // just so it exists for purposes of reading ident2 etc. later on, and no exception is thrown } } - if (GUARD_SIGNS) { - if (op[0] == 'u' || (variant && variant[0] == 'u')) { - ident1 = makeSignOp(ident1, type, 'un'); - ident2 = makeSignOp(ident2, type, 'un'); - } else if (op[0] == 's' || (variant && variant[0] == 's')) { - ident1 = makeSignOp(ident1, type, 're'); - ident2 = makeSignOp(ident2, type, 're'); - } + if (op[0] == 'u' || op[0] == 'z' || (variant && variant[0] == 'u')) { // z for zext, see below + ident1 = makeSignOp(ident1, type, 'un'); + ident2 = makeSignOp(ident2, type, 'un'); + } else if (op[0] == 's' || (variant && variant[0] == 's')) { + ident1 = makeSignOp(ident1, type, 're'); + ident2 = makeSignOp(ident2, type, 're'); } var bits = null; if (item.type[0] === 'i') { @@ -838,13 +840,17 @@ function JSify(data, functionsOnly, givenTypes, givenFunctions, givenGlobalVaria default: throw 'Unknown fcmp variant: ' + variant; } } - case 'zext': case 'fpext': case 'sext': case 'fptrunc': return ident1; + // Note that zext has sign checking, see above. We must guard against -33 in i8 turning into -33 in i32 + // then unsigning that i32... which would give something huge. + case 'zext': case 'fpext': case 'sext': return ident1; + case 'fptrunc': return ident1; case 'trunc': { // Unlike extending, which we just 'do' (by doing nothing), // truncating can change the number, e.g. by truncating to an i1 // in order to get the first bit assert(ident2[0] == 'i'); var bitsLeft = ident2.substr(1); + assert(bitsLeft <= 32, 'Cannot truncate to more than 32 bits, since we use a native & op'); return '((' + ident1 + ') & ' + (Math.pow(2, bitsLeft)-1) + ')'; } case 'select': return ident1 + ' ? ' + ident2 + ' : ' + ident3; diff --git a/src/library.js b/src/library.js index b60bd07f..4b315a9e 100644 --- a/src/library.js +++ b/src/library.js @@ -168,6 +168,12 @@ var Library = { } } return Pointer_make(ret.concat(0), 0, ALLOC_STACK); // NB: Stored on the stack + //var len = ret.length+1; + //var ret = Pointer_make(ret.concat(0), 0, ALLOC_STACK); // NB: Stored on the stack + //STACKTOP -= len; // XXX horrible hack. we rewind the stack, to 'undo' the alloc we just did. + // // the point is that this works if nothing else allocs on the stack before + // // the string is read, which should be true - it is very transient, see the *printf* functions below. + //return ret; }, printf__deps: ['_formatString'], @@ -451,7 +457,7 @@ var Library = { exit: function(status) { __shutdownRuntime__(); ABORT = true; - throw 'exit(' + status + ') called.'; + throw 'exit(' + status + ') called, at ' + new Error().stack; }, atexit: function(func) { @@ -541,6 +547,7 @@ var Library = { // TODO: optimize for the typed arrays case // || 0, since memcpy sometimes copies uninitialized areas XXX: Investigate why initializing alloc'ed memory does not fix that too {{{ makeCopyValue('dest', 'i', 'src', 'i', 'null', ' || 0') }}}; + // XXX Try copying the safe-heap type info, instead of using null } }, llvm_memcpy_i32: 'memcpy', |