https://git.ruby-lang.org/ruby.git/commit/?id=020f745041

From 020f745041d8555ccd287553a098402c04f9e248 Mon Sep 17 00:00:00 2001
From: Maxime Chevalier-Boisvert <maxime.chevalierboisvert@s...>
Date: Tue, 2 Feb 2021 14:31:02 -0500
Subject: Fix overflow check in ujit

---
 ujit_codegen.c | 5 ++---
 ujit_core.c    | 8 ++++----
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/ujit_codegen.c b/ujit_codegen.c
index e5e7b90e59..33b0e8edd6 100644
--- a/ujit_codegen.c
+++ b/ujit_codegen.c
@@ -1128,11 +1128,10 @@ gen_opt_swb_iseq(jitstate_t* jit, ctx_t* ctx, struct rb_call_data * cd, const rb https://github.com/ruby/ruby/blob/trunk/ujit_codegen.c#L1128
 
     // Stack overflow check
     // #define CHECK_VM_STACK_OVERFLOW0(cfp, sp, margin)
-    // REG_CFP <= REG_SP + 4 * sizeof(VALUE) + sizeof(rb_control_frame_t)
-    lea(cb, REG0, ctx_sp_opnd(ctx, sizeof(VALUE) * 4 + sizeof(rb_control_frame_t)));
+    lea(cb, REG0, ctx_sp_opnd(ctx, sizeof(VALUE) * (num_locals + iseq->body->stack_max) + sizeof(rb_control_frame_t)));
     cmp(cb, REG_CFP, REG0);
     jle_ptr(cb, side_exit);
-    
+
     // Adjust the callee's stack pointer
     lea(cb, REG0, ctx_sp_opnd(ctx, sizeof(VALUE) * (3 + num_locals)));
 
diff --git a/ujit_core.c b/ujit_core.c
index 8e11d53992..6daab05a46 100644
--- a/ujit_core.c
+++ b/ujit_core.c
@@ -32,7 +32,7 @@ Get an operand for the adjusted stack pointer address https://github.com/ruby/ruby/blob/trunk/ujit_core.c#L32
 x86opnd_t
 ctx_sp_opnd(ctx_t* ctx, int32_t offset_bytes)
 {
-    int32_t offset = (ctx->stack_size) * 8 + offset_bytes;
+    int32_t offset = (ctx->stack_size) * sizeof(VALUE) + offset_bytes;
     return mem_opnd(64, REG_SP, offset);
 }
 
@@ -51,7 +51,7 @@ ctx_stack_push(ctx_t* ctx, int type) https://github.com/ruby/ruby/blob/trunk/ujit_core.c#L51
     ctx->stack_size += 1;
 
     // SP points just above the topmost value
-    int32_t offset = (ctx->stack_size - 1) * 8;
+    int32_t offset = (ctx->stack_size - 1) * sizeof(VALUE);
     return mem_opnd(64, REG_SP, offset);
 }
 
@@ -65,7 +65,7 @@ ctx_stack_pop(ctx_t* ctx, size_t n) https://github.com/ruby/ruby/blob/trunk/ujit_core.c#L65
     RUBY_ASSERT(n <= ctx->stack_size);
 
     // SP points just above the topmost value
-    int32_t offset = (ctx->stack_size - 1) * 8;
+    int32_t offset = (ctx->stack_size - 1) * sizeof(VALUE);
     x86opnd_t top = mem_opnd(64, REG_SP, offset);
 
     // Clear the types of the popped values
@@ -88,7 +88,7 @@ x86opnd_t https://github.com/ruby/ruby/blob/trunk/ujit_core.c#L88
 ctx_stack_opnd(ctx_t* ctx, int32_t idx)
 {
     // SP points just above the topmost value
-    int32_t offset = (ctx->stack_size - 1 - idx) * 8;
+    int32_t offset = (ctx->stack_size - 1 - idx) * sizeof(VALUE);
     x86opnd_t opnd = mem_opnd(64, REG_SP, offset);
 
     return opnd;
-- 
cgit v1.2.1


--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/