Experimental: use the Result class to manage the lifetime of registers...

src/codegen-ia32.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2646 matching lines @@
     ref.GetValue(typeof_state());
   }
 }
 
 
 void CodeGenerator::VisitLiteral(Literal* node) {
   Comment cmnt(masm_, "[ Literal");
   if (node->handle()->IsSmi() && !IsInlineSmi(node)) {
     // To prevent long attacker-controlled byte sequences in code, larger
     // Smis are loaded in two steps via a temporary register.
-    Register temp = allocator_->Allocate();
+    Result temp = allocator_->Allocate();
+    ASSERT(temp.is_valid());
     int bits = reinterpret_cast<int>(*node->handle());
-    ASSERT(!temp.is(no_reg));
-    __ mov(temp, bits & 0x0000FFFF);
-    __ xor_(temp, bits & 0xFFFF0000);
-    frame_->Push(temp);
-    allocator_->Unuse(temp);
+    __ mov(temp.reg(), bits & 0x0000FFFF);
+    __ xor_(temp.reg(), bits & 0xFFFF0000);
+    frame_->Push(&temp);

[William Hesse, 2008/12/19 08:41:03]

I thought this was in the assembler's Set() function.  Once we have constant
folding, the attacker can put a 32-bit SMI in the code by x = bad_word - 1 + 1. 
Can this be put in Set() instead?

[Kevin Millikin (Chromium), 2008/12/19 08:48:11]

Possibly, but there's probably a better way.  Ideally (once we have constant
folding :)) we will just track whether values are "contaminated" by originating
with source literals.

MacroAssembler::Set is too low-level for that.  It doesn't have any idea about
where the operand originated, and it's too late to figure it out by the time
it's called.

   } else {
     frame_->Push(node->handle());
   }
 }
 
 
 class RegExpDeferred: public DeferredCode {
  public:
   RegExpDeferred(CodeGenerator* generator, RegExpLiteral* node)
       : DeferredCode(generator), node_(node) {
@@ skipping 2980 matching lines @@
 
   // Slow-case: Go through the JavaScript implementation.
   __ bind(&slow);
   __ InvokeBuiltin(Builtins::INSTANCE_OF, JUMP_FUNCTION);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal