Fix overflow in arm simulator.

src/arm/simulator-arm.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1000 matching lines @@
 
 // For use in calls that take two double values, constructed either
 // from r0-r3 or d0 and d1.
 void Simulator::GetFpArgs(double* x, double* y) {
   if (use_eabi_hardfloat()) {
     *x = vfp_register[0];
     *y = vfp_register[1];
   } else {
     // We use a char buffer to get around the strict-aliasing rules which
     // otherwise allow the compiler to optimize away the copy.
-    char buffer[2 * sizeof(registers_[0])];
+    char buffer[sizeof(*x)];
     // Registers 0 and 1 -> x.
-    memcpy(buffer, registers_, sizeof(buffer));
-    memcpy(x, buffer, sizeof(buffer));
+    memcpy(buffer, registers_, sizeof(*x));
+    memcpy(x, buffer, sizeof(*x));
     // Registers 2 and 3 -> y.
-    memcpy(buffer, registers_ + 2, sizeof(buffer));
-    memcpy(y, buffer, sizeof(buffer));
+    memcpy(buffer, registers_ + 2, sizeof(*y));
+    memcpy(y, buffer, sizeof(*y));
   }
 }
 
 // For use in calls that take one double value, constructed either
 // from r0 and r1 or d0.
 void Simulator::GetFpArgs(double* x) {
   if (use_eabi_hardfloat()) {
     *x = vfp_register[0];
   } else {
     // We use a char buffer to get around the strict-aliasing rules which
     // otherwise allow the compiler to optimize away the copy.
-    char buffer[2 * sizeof(registers_[0])];
+    char buffer[sizeof(*x)];
     // Registers 0 and 1 -> x.
-    memcpy(buffer, registers_, sizeof(buffer));
-    memcpy(x, buffer, sizeof(buffer));
+    memcpy(buffer, registers_, sizeof(*x));
+    memcpy(x, buffer, sizeof(*x));
   }
 }
 
 
-// For use in calls that take two double values, constructed either
-// from r0-r3 or d0 and d1.
+// For use in calls that take one double value constructed either
+// from r0 and r1 or d0 and one integer value.
 void Simulator::GetFpArgs(double* x, int32_t* y) {
   if (use_eabi_hardfloat()) {
     *x = vfp_register[0];
     *y = registers_[1];
   } else {
     // We use a char buffer to get around the strict-aliasing rules which
     // otherwise allow the compiler to optimize away the copy.
-    char buffer[2 * sizeof(registers_[0])];
+    char buffer[sizeof(*x)];
     // Registers 0 and 1 -> x.
-    memcpy(buffer, registers_, sizeof(buffer));
-    memcpy(x, buffer, sizeof(buffer));
-    // Registers 2 and 3 -> y.
-    memcpy(buffer, registers_ + 2, sizeof(buffer));
-    memcpy(y, buffer, sizeof(buffer));
+    memcpy(buffer, registers_, sizeof(*x));
+    memcpy(x, buffer, sizeof(*x));
+    // Register 2 -> y.
+    memcpy(buffer, registers_ + 2, sizeof(*y));
+    memcpy(y, buffer, sizeof(*y));
   }
 }
 
 
 // The return value is either in r0/r1 or d0.
 void Simulator::SetFpResult(const double& result) {
   if (use_eabi_hardfloat()) {
     char buffer[2 * sizeof(vfp_register[0])];
     memcpy(buffer, &result, sizeof(buffer));
     // Copy result to d0.
@@ skipping 2345 matching lines @@
   uintptr_t address = *stack_slot;
   set_register(sp, current_sp + sizeof(uintptr_t));
   return address;
 }
 
 } }  // namespace v8::internal
 
 #endif  // USE_SIMULATOR
 
 #endif  // V8_TARGET_ARCH_ARM