[Libjit-developers] libjit interpreter stack smash (yet again)

[Gopal V]

Hi,

http://t3.dotgnu.info/code/jit_nullcheck.c

If you run that peice of code with an argument, it will return

function 0x0804A088(ptr) : ptr
        55748008: prolog(0x804A088, 12, 36, 3)
        55748018: ldarg_int 0
        55748020: check_null
        55748024: ldarg_int 0
        5574802C: push_const_int 4
        55748034: iadd
        55748038: return_int
end

But if I run the same code without any arguments (the jit code
called is different).

function 0x0804A088(ptr) : ptr
        55748008: prolog(0x804A088, 12, 24, 2)
        55748018: ldarg_int 0
        55748020: check_null
        55748024: ldarg_int 0
        5574802C: push_const_int 4
        55748034: iadd
        55748038: return_int
end

Now, the code looks almost identical, except for one fact. The
second case has only 2 stack items, while the first one has
3. And it indeed uses three stack items anyway.

Somehow the unary note code inside check_null isn't setting the
value of arg as "in_register". The behavior appears only when
there are multiple blocks and the spill at the end of the block
does not pop out the check_null (which should've happened in
case #2).

Any help would be appreciated :(

Cheers,
Gopal
--
If I learn from my mistakes, pretty soon I'll know everything.