Fix a fallthrough bug in TranslatorX64::smash
If smash is told to generate a forward jump to a target less than 7 bytes away, it nops out the intermediate region. It's currently impossible for this to cause any issues (as far as I know), but technically there can be other instructions in there. I hit this by randomizing the layout of blocks in codegen---if you place a block consisting of only a short backward jump immediately after the block containing the main trace exit, and then a fallthrough-ish translation occurs, smash will nop out the short-jump block.
Esse commit está contido em:
@@ -1542,7 +1542,7 @@ TranslatorX64::smash(X64Assembler &a, TCA src, TCA dest, bool isCall) {
|
||||
*/
|
||||
CodeCursor cg(a, src);
|
||||
assert(isSmashable(a.code.frontier, kJmpLen));
|
||||
if (dest > src && dest - src <= 7) {
|
||||
if (dest > src && dest - src <= kJmpLen) {
|
||||
assert(!isCall);
|
||||
a. emitNop(dest - src);
|
||||
} else if (!isCall) {
|
||||
|
||||
Referência em uma Nova Issue
Bloquear um usuário