path: root/src/qml/jsruntime/qv4script_p.h
diff options
authorErik Verbruggen <>2015-07-08 10:52:59 +0200
committerErik Verbruggen <>2015-07-24 11:44:05 +0000
commit92836d052efb6d8073136e8507083f93fb60bb80 (patch)
treeb540fb91fb1a580ac7bd11134fa36ee8fc64df51 /src/qml/jsruntime/qv4script_p.h
parent2cc48fbdb2eb10858045eb4877c45d981fa55698 (diff)
Remove type punning from QV4::Value.
The union in QV4::Value is used to do type punning. In C++, this is compiler-defined behavior. For example, Clang and GCC will try to detect it and try to do the proper thing. However, it can play havoc with Alias Analysis, and it is not guaranteed that some Undefined Behavior (or Compiler depenedent behavior) might occur. The really problematic part is the struct inside the union: depending on the calling convention and the register size, it results in some exciting code. For example, the AMD64 ABI specifies that a struct of two values of INTEGER class can be passed in separate registers when doing a function call. Now, if the AA in the compiler looses track of the fact that the tag overlaps with the double, you might get: ecx := someTag ... conditional jumps double_case: rdx := xorredDoubleValue callq someWhere If the someWhere function checks for the tag first, mayhem ensues: the double value in rdx does not overwrite the tag that is passed in ecx. Changing the code to do reinterpret_cast<>s might also give problems on 32bit architectures, because there is a double, whose size is not the same as the size of the tag, which could confuse AA. So, to fix this, the following is changed: - only have a quint64 field in the QV4::Value, which has the added benefit that it's very clear for the compiler that it's a POD - as memcpy is the only approved way to ensure bit-by-bit "conversion" between types (esp. FP<->non-FP types), change all conversions to use memcpy. Use bitops (shift/and/or) for anything else. - only use accessor functions for non-quint64 values As any modern compiler has memcpy as an intrinsic, the call will be replaced with one or a few move instructions. The accessor functions also get inlined, the bitops get optimized, so in all cases the compiler can generate the most compact code possible. This patch obsoletes f558bc48585c69de36151248c969a484a969ebb4 (which had the exact aliassing problem of the double and the tag as described above). Change-Id: I60a39d8564be5ce6106403a56a8de90943217006 Reviewed-by: Ulf Hermann <>
Diffstat (limited to 'src/qml/jsruntime/qv4script_p.h')
1 files changed, 3 insertions, 3 deletions
diff --git a/src/qml/jsruntime/qv4script_p.h b/src/qml/jsruntime/qv4script_p.h
index 015bfff56a..77784dfc4f 100644
--- a/src/qml/jsruntime/qv4script_p.h
+++ b/src/qml/jsruntime/qv4script_p.h
@@ -63,7 +63,7 @@ struct ContextStateSaver {
, compilationUnit(context->d()->compilationUnit)
, lineNumber(context->d()->lineNumber)
- savedContext->m = context->d();
+ savedContext->setM(context->d());
ContextStateSaver(Scope &scope, Heap::ExecutionContext *context)
: savedContext(scope.alloc(1))
@@ -72,12 +72,12 @@ struct ContextStateSaver {
, compilationUnit(context->compilationUnit)
, lineNumber(context->lineNumber)
- savedContext->m = context;
+ savedContext->setM(context);
- Heap::ExecutionContext *ctx = static_cast<Heap::ExecutionContext *>(savedContext->m);
+ Heap::ExecutionContext *ctx = static_cast<Heap::ExecutionContext *>(savedContext->m());
ctx->strictMode = strictMode;
ctx->lookups = lookups;
ctx->compilationUnit = compilationUnit;