summaryrefslogtreecommitdiffstats
diff options
authorMichal Klocek <michal.klocek@qt.io>2025-03-14 14:19:51 +0100
committerMichal Klocek <michal.klocek@qt.io>2025-03-14 13:33:56 +0000
commit398abfcf3112d21a3edd058004afbb62cd0d4173 (patch)
tree94919b6e6b06f238185c2ff352774e19dac00fb0
parentf447f8cfe30146f131e8f50e14735f34d10d7d68 (diff)
[fixup] CVE-2024-12693: Out of bounds memory access in V8118-based
Guard loop in EnsurePhiInputsTagged insted of ConvertTaggedPhiTo. Change-Id: Iff6b09349feaa31e4cef23b20ac1334e24b13231 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/631787 Reviewed-by: Anu Aliyas <anu.aliyas@qt.io>
-rw-r--r--chromium/v8/src/maglev/maglev-phi-representation-selector.cc6
1 files changed, 3 insertions, 3 deletions
diff --git a/chromium/v8/src/maglev/maglev-phi-representation-selector.cc b/chromium/v8/src/maglev/maglev-phi-representation-selector.cc
index d43a76d811c..7d36df6a8c5 100644
--- a/chromium/v8/src/maglev/maglev-phi-representation-selector.cc
+++ b/chromium/v8/src/maglev/maglev-phi-representation-selector.cc
@@ -219,7 +219,8 @@ void MaglevPhiRepresentationSelector::EnsurePhiInputsTagged(Phi* phi) {
// should be tagged. We'll thus insert tagging operation on the untagged phi
// inputs of {phi}.
- for (int i = 0; i < phi->input_count(); i++) {
+ const int skip_backedge = phi->is_loop_phi() ? 1 : 0;
+ for (int i = 0; i < phi->input_count() - skip_backedge; i++) {
ValueNode* input = phi->input(i).node();
if (Phi* phi_input = input->TryCast<Phi>()) {
phi->set_input(i, EnsurePhiTagged(phi_input, phi->predecessor_at(i),
@@ -327,8 +328,7 @@ void MaglevPhiRepresentationSelector::ConvertTaggedPhiTo(
// registers to floating registers.
phi->InitializeRegisterData();
- const int skip_backedge = phi->is_loop_phi() ? 1 : 0;
- for (int i = 0; i < phi->input_count() - skip_backedge; i++) {
+ for (int i = 0; i < phi->input_count(); i++) {
ValueNode* input = phi->input(i).node();
#define TRACE_INPUT_LABEL \
" @ Input " << i << " (" << PrintNodeLabel(graph_labeller(), input) << ")"