aboutsummaryrefslogtreecommitdiff
path: root/gnu/packages/patches/icecat-CVE-2015-2724-pt2.patch
diff options
context:
space:
mode:
Diffstat (limited to 'gnu/packages/patches/icecat-CVE-2015-2724-pt2.patch')
-rw-r--r--gnu/packages/patches/icecat-CVE-2015-2724-pt2.patch391
1 files changed, 0 insertions, 391 deletions
diff --git a/gnu/packages/patches/icecat-CVE-2015-2724-pt2.patch b/gnu/packages/patches/icecat-CVE-2015-2724-pt2.patch
deleted file mode 100644
index 486e92c66d..0000000000
--- a/gnu/packages/patches/icecat-CVE-2015-2724-pt2.patch
+++ /dev/null
@@ -1,391 +0,0 @@
-From 99641aa4446dc9df04dcfeede8b49ff03abcac42 Mon Sep 17 00:00:00 2001
-From: Jan de Mooij <jdemooij@mozilla.com>
-Date: Thu, 28 May 2015 10:16:24 +0200
-Subject: [PATCH] Bug 1160884 - Add KeepAlive instructions after elements/slots
- uses. r=nbp, a=abillings
-
----
- js/src/jit/CodeGenerator.cpp | 7 ++
- js/src/jit/CodeGenerator.h | 1 +
- js/src/jit/Ion.cpp | 7 ++
- js/src/jit/IonAnalysis.cpp | 112 ++++++++++++++++++++++++++++++++
- js/src/jit/IonAnalysis.h | 3 +
- js/src/jit/LIR-Common.h | 14 ++++
- js/src/jit/LOpcodes.h | 1 +
- js/src/jit/Lowering.cpp | 9 +++
- js/src/jit/Lowering.h | 1 +
- js/src/jit/MIR.h | 26 ++++++++
- js/src/jit/MOpcodes.h | 1 +
- js/src/jit/ParallelSafetyAnalysis.cpp | 1 +
- js/src/jit/shared/Lowering-shared-inl.h | 8 ++-
- js/src/jit/shared/Lowering-shared.h | 1 +
- js/src/vm/TraceLogging.h | 3 +-
- 15 files changed, 193 insertions(+), 2 deletions(-)
-
-diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
-index 5dff9df..7364178 100644
---- a/js/src/jit/CodeGenerator.cpp
-+++ b/js/src/jit/CodeGenerator.cpp
-@@ -1476,6 +1476,13 @@ CodeGenerator::visitPointer(LPointer* lir)
- }
-
- bool
-+CodeGenerator::visitKeepAliveObject(LKeepAliveObject* lir)
-+{
-+ // No-op.
-+ return true;
-+}
-+
-+bool
- CodeGenerator::visitSlots(LSlots* lir)
- {
- Address slots(ToRegister(lir->object()), JSObject::offsetOfSlots());
-diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
-index 95fb33b..e3b4fd7 100644
---- a/js/src/jit/CodeGenerator.h
-+++ b/js/src/jit/CodeGenerator.h
-@@ -106,6 +106,7 @@ class CodeGenerator : public CodeGeneratorSpecific
- bool visitLambdaForSingleton(LLambdaForSingleton* lir);
- bool visitLambdaPar(LLambdaPar* lir);
- bool visitPointer(LPointer* lir);
-+ bool visitKeepAliveObject(LKeepAliveObject* lir);
- bool visitSlots(LSlots* lir);
- bool visitStoreSlotV(LStoreSlotV* store);
- bool visitElements(LElements* lir);
-diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
-index 015d387..1551a80 100644
---- a/js/src/jit/Ion.cpp
-+++ b/js/src/jit/Ion.cpp
-@@ -1536,6 +1536,13 @@ OptimizeMIR(MIRGenerator* mir)
- AssertGraphCoherency(graph);
- }
-
-+ if (!mir->compilingAsmJS()) {
-+ AutoTraceLog log(logger, TraceLogger::AddKeepAliveInstructions);
-+ AddKeepAliveInstructions(graph);
-+ IonSpewPass("Add KeepAlive Instructions");
-+ AssertGraphCoherency(graph);
-+ }
-+
- return true;
- }
-
-diff --git a/js/src/jit/IonAnalysis.cpp b/js/src/jit/IonAnalysis.cpp
-index 8965724..af58aae 100644
---- a/js/src/jit/IonAnalysis.cpp
-+++ b/js/src/jit/IonAnalysis.cpp
-@@ -1971,6 +1971,118 @@ jit::UnsplitEdges(LIRGraph* lir)
- return true;
- }
-
-+static bool
-+NeedsKeepAlive(MInstruction* slotsOrElements, MInstruction* use)
-+{
-+ MOZ_ASSERT(slotsOrElements->type() == MIRType_Elements ||
-+ slotsOrElements->type() == MIRType_Slots);
-+
-+ if (slotsOrElements->block() != use->block())
-+ return true;
-+
-+ MBasicBlock* block = use->block();
-+ MInstructionIterator iter(block->begin(slotsOrElements));
-+ MOZ_ASSERT(*iter == slotsOrElements);
-+ ++iter;
-+
-+ while (true) {
-+ if (*iter == use)
-+ return false;
-+
-+ switch (iter->op()) {
-+ case MDefinition::Op_Nop:
-+ case MDefinition::Op_Constant:
-+ case MDefinition::Op_KeepAliveObject:
-+ case MDefinition::Op_Unbox:
-+ case MDefinition::Op_LoadSlot:
-+ case MDefinition::Op_StoreSlot:
-+ case MDefinition::Op_LoadFixedSlot:
-+ case MDefinition::Op_StoreFixedSlot:
-+ case MDefinition::Op_LoadElement:
-+ case MDefinition::Op_StoreElement:
-+ case MDefinition::Op_InitializedLength:
-+ case MDefinition::Op_ArrayLength:
-+ case MDefinition::Op_BoundsCheck:
-+ iter++;
-+ break;
-+ default:
-+ return true;
-+ }
-+ }
-+
-+ MOZ_CRASH("Unreachable");
-+}
-+
-+void
-+jit::AddKeepAliveInstructions(MIRGraph& graph)
-+{
-+ for (MBasicBlockIterator i(graph.begin()); i != graph.end(); i++) {
-+ MBasicBlock* block = *i;
-+
-+ for (MInstructionIterator insIter(block->begin()); insIter != block->end(); insIter++) {
-+ MInstruction* ins = *insIter;
-+ if (ins->type() != MIRType_Elements && ins->type() != MIRType_Slots)
-+ continue;
-+
-+ MDefinition* ownerObject;
-+ switch (ins->op()) {
-+ case MDefinition::Op_ConstantElements:
-+ case MDefinition::Op_NewSlots:
-+ continue;
-+ case MDefinition::Op_ConvertElementsToDoubles:
-+ // EliminateRedundantChecks should have replaced all uses.
-+ MOZ_ASSERT(!ins->hasUses());
-+ continue;
-+ case MDefinition::Op_Elements:
-+ case MDefinition::Op_TypedArrayElements:
-+ case MDefinition::Op_TypedObjectElements:
-+ MOZ_ASSERT(ins->numOperands() == 1);
-+ ownerObject = ins->getOperand(0);
-+ break;
-+ case MDefinition::Op_Slots:
-+ ownerObject = ins->toSlots()->object();
-+ break;
-+ default:
-+ MOZ_CRASH("Unexpected op");
-+ }
-+
-+ MOZ_ASSERT(ownerObject->type() == MIRType_Object);
-+
-+ if (ownerObject->isConstant()) {
-+ // Constants are kept alive by other pointers, for instance
-+ // ImmGCPtr in JIT code.
-+ continue;
-+ }
-+
-+ for (MUseDefIterator uses(ins); uses; uses++) {
-+ MInstruction* use = uses.def()->toInstruction();
-+
-+ if (use->isStoreElementHole()) {
-+ // StoreElementHole has an explicit object operand. If GVN
-+ // is disabled, we can get different unbox instructions with
-+ // the same object as input, so we check for that case.
-+ MOZ_ASSERT_IF(!use->toStoreElementHole()->object()->isUnbox() && !ownerObject->isUnbox(),
-+ use->toStoreElementHole()->object() == ownerObject);
-+ continue;
-+ }
-+
-+ if (use->isInArray()) {
-+ // See StoreElementHole case above.
-+ MOZ_ASSERT_IF(!use->toInArray()->object()->isUnbox() && !ownerObject->isUnbox(),
-+ use->toInArray()->object() == ownerObject);
-+ continue;
-+ }
-+
-+ if (!NeedsKeepAlive(ins, use))
-+ continue;
-+
-+ MKeepAliveObject* keepAlive = MKeepAliveObject::New(graph.alloc(), ownerObject);
-+ use->block()->insertAfter(use, keepAlive);
-+ }
-+ }
-+ }
-+}
-+
- bool
- LinearSum::multiply(int32_t scale)
- {
-diff --git a/js/src/jit/IonAnalysis.h b/js/src/jit/IonAnalysis.h
-index aabf835..a320418 100644
---- a/js/src/jit/IonAnalysis.h
-+++ b/js/src/jit/IonAnalysis.h
-@@ -64,6 +64,9 @@ AssertExtendedGraphCoherency(MIRGraph& graph);
- bool
- EliminateRedundantChecks(MIRGraph& graph);
-
-+void
-+AddKeepAliveInstructions(MIRGraph& graph);
-+
- bool
- UnsplitEdges(LIRGraph* lir);
-
-diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
-index 5fe0ee9..6b03a42 100644
---- a/js/src/jit/LIR-Common.h
-+++ b/js/src/jit/LIR-Common.h
-@@ -3591,6 +3591,20 @@ class LImplicitThis : public LInstructionHelper<BOX_PIECES, 1, 0>
- }
- };
-
-+class LKeepAliveObject : public LInstructionHelper<0, 1, 0>
-+{
-+ public:
-+ LIR_HEADER(KeepAliveObject)
-+
-+ explicit LKeepAliveObject(const LAllocation& object) {
-+ setOperand(0, object);
-+ }
-+
-+ const LAllocation* object() {
-+ return getOperand(0);
-+ }
-+};
-+
- // Load the "slots" member out of a JSObject.
- // Input: JSObject pointer
- // Output: slots pointer
-diff --git a/js/src/jit/LOpcodes.h b/js/src/jit/LOpcodes.h
-index cd7eef8..424b22c 100644
---- a/js/src/jit/LOpcodes.h
-+++ b/js/src/jit/LOpcodes.h
-@@ -166,6 +166,7 @@
- _(LambdaForSingleton) \
- _(LambdaPar) \
- _(ImplicitThis) \
-+ _(KeepAliveObject) \
- _(Slots) \
- _(Elements) \
- _(ConvertElementsToDoubles) \
-diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
-index d671fd4..c0d434e 100644
---- a/js/src/jit/Lowering.cpp
-+++ b/js/src/jit/Lowering.cpp
-@@ -2110,6 +2110,15 @@ LIRGenerator::visitImplicitThis(MImplicitThis* ins)
- }
-
- bool
-+LIRGenerator::visitKeepAliveObject(MKeepAliveObject* ins)
-+{
-+ MDefinition* obj = ins->object();
-+ MOZ_ASSERT(obj->type() == MIRType_Object);
-+
-+ return add(new(alloc()) LKeepAliveObject(useKeepalive(obj)), ins);
-+}
-+
-+bool
- LIRGenerator::visitSlots(MSlots* ins)
- {
- return define(new(alloc()) LSlots(useRegisterAtStart(ins->object())), ins);
-diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h
-index ea50cab..a60dc30 100644
---- a/js/src/jit/Lowering.h
-+++ b/js/src/jit/Lowering.h
-@@ -160,6 +160,7 @@ class LIRGenerator : public LIRGeneratorSpecific
- bool visitLambdaArrow(MLambdaArrow* ins);
- bool visitLambdaPar(MLambdaPar* ins);
- bool visitImplicitThis(MImplicitThis* ins);
-+ bool visitKeepAliveObject(MKeepAliveObject* ins);
- bool visitSlots(MSlots* ins);
- bool visitElements(MElements* ins);
- bool visitConstantElements(MConstantElements* ins);
-diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
-index 48e1dfb..a6060a2 100644
---- a/js/src/jit/MIR.h
-+++ b/js/src/jit/MIR.h
-@@ -5790,6 +5790,32 @@ class MSetTypedObjectOffset
- }
- };
-
-+class MKeepAliveObject
-+ : public MUnaryInstruction,
-+ public SingleObjectPolicy
-+{
-+ explicit MKeepAliveObject(MDefinition* object)
-+ : MUnaryInstruction(object)
-+ {
-+ setResultType(MIRType_None);
-+ setGuard();
-+ }
-+
-+ public:
-+ INSTRUCTION_HEADER(KeepAliveObject)
-+
-+ static MKeepAliveObject* New(TempAllocator& alloc, MDefinition* object) {
-+ return new(alloc) MKeepAliveObject(object);
-+ }
-+
-+ MDefinition* object() const {
-+ return getOperand(0);
-+ }
-+ TypePolicy* typePolicy() {
-+ return this;
-+ }
-+};
-+
- // Perform !-operation
- class MNot
- : public MUnaryInstruction,
-diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h
-index 83b9e63..cfc3895 100644
---- a/js/src/jit/MOpcodes.h
-+++ b/js/src/jit/MOpcodes.h
-@@ -110,6 +110,7 @@ namespace jit {
- _(Lambda) \
- _(LambdaArrow) \
- _(ImplicitThis) \
-+ _(KeepAliveObject) \
- _(Slots) \
- _(Elements) \
- _(ConstantElements) \
-diff --git a/js/src/jit/ParallelSafetyAnalysis.cpp b/js/src/jit/ParallelSafetyAnalysis.cpp
-index a6a1202..13c577b 100644
---- a/js/src/jit/ParallelSafetyAnalysis.cpp
-+++ b/js/src/jit/ParallelSafetyAnalysis.cpp
-@@ -199,6 +199,7 @@ class ParallelSafetyVisitor : public MInstructionVisitor
- CUSTOM_OP(Lambda)
- UNSAFE_OP(LambdaArrow)
- UNSAFE_OP(ImplicitThis)
-+ SAFE_OP(KeepAliveObject)
- SAFE_OP(Slots)
- SAFE_OP(Elements)
- SAFE_OP(ConstantElements)
-diff --git a/js/src/jit/shared/Lowering-shared-inl.h b/js/src/jit/shared/Lowering-shared-inl.h
-index 17bb74a..832cc61 100644
---- a/js/src/jit/shared/Lowering-shared-inl.h
-+++ b/js/src/jit/shared/Lowering-shared-inl.h
-@@ -372,11 +372,17 @@ LIRGeneratorShared::useStorableAtStart(MDefinition* mir)
- #endif
-
- LAllocation
-+LIRGeneratorShared::useKeepalive(MDefinition* mir)
-+{
-+ return use(mir, LUse(LUse::KEEPALIVE));
-+}
-+
-+LAllocation
- LIRGeneratorShared::useKeepaliveOrConstant(MDefinition* mir)
- {
- if (mir->isConstant())
- return LAllocation(mir->toConstant()->vp());
-- return use(mir, LUse(LUse::KEEPALIVE));
-+ return useKeepalive(mir);
- }
-
- LUse
-diff --git a/js/src/jit/shared/Lowering-shared.h b/js/src/jit/shared/Lowering-shared.h
-index 4bd13b0..b23d20e 100644
---- a/js/src/jit/shared/Lowering-shared.h
-+++ b/js/src/jit/shared/Lowering-shared.h
-@@ -85,6 +85,7 @@ class LIRGeneratorShared : public MInstructionVisitorWithDefaults
- // this is a generic "things we can expect to write into memory in 1 instruction"
- inline LAllocation useStorable(MDefinition* mir);
- inline LAllocation useStorableAtStart(MDefinition* mir);
-+ inline LAllocation useKeepalive(MDefinition* mir);
- inline LAllocation useKeepaliveOrConstant(MDefinition* mir);
- inline LAllocation useRegisterOrConstant(MDefinition* mir);
- inline LAllocation useRegisterOrConstantAtStart(MDefinition* mir);
-diff --git a/js/src/vm/TraceLogging.h b/js/src/vm/TraceLogging.h
-index 4c2ebfe..8447679 100644
---- a/js/src/vm/TraceLogging.h
-+++ b/js/src/vm/TraceLogging.h
-@@ -145,7 +145,8 @@ namespace jit {
- _(EffectiveAddressAnalysis) \
- _(EliminateDeadCode) \
- _(EdgeCaseAnalysis) \
-- _(EliminateRedundantChecks)
-+ _(EliminateRedundantChecks) \
-+ _(AddKeepAliveInstructions)
-
- class AutoTraceLog;
-
---
-2.4.3
-