suzanne.soy/racket
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix broken info use after JIT buffer overflow

Browse Source 
After the JIT buffer becomes too full, some paths
don't bail out fast enough, so guard against
broken info in some relatively new uses of the info.

Merge to v6.4
This commit is contained in:
Matthew Flatt 2016-01-17 16:05:53 -07:00
parent e133d87765
commit e0cc61d5af
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
racket/src/racket/src/jit.c
View File

@ -455,6 +455,8 @@ Scheme_Object *scheme_extract_global(Scheme_Object *o, Scheme_Native_Closure *nc
static Scheme_Object *extract_closure_local(int pos, mz_jit_state *jitter, int get_constant)
{
if (PAST_LIMIT()) return NULL;
if (pos >= jitter->self_pos - jitter->self_to_closure_delta) {
pos -= (jitter->self_pos - jitter->self_to_closure_delta);
if (pos < jitter->nc->code->u2.orig_code->closure_size) {
@ -490,6 +492,8 @@ Scheme_Object *scheme_specialize_to_constant(Scheme_Object *obj, mz_jit_state *j
{
Scheme_Object *c;
if (PAST_LIMIT()) return obj;
if (SCHEME_NATIVE_CLOSURE_DATA_FLAGS(jitter->nc->code) & NATIVE_SPECIALIZED) {
if (SAME_TYPE(SCHEME_TYPE(obj), scheme_local_type)) {
c = scheme_extract_closure_local(obj, jitter, extra_push, 1);