Experimental: use the Result class to manage the lifetime of registers...

src/codegen-ia32.cc

Index: src/codegen-ia32.cc
===================================================================
--- src/codegen-ia32.cc	(revision 999)
+++ src/codegen-ia32.cc	(working copy)
@@ -2664,13 +2664,12 @@
   if (node->handle()->IsSmi() && !IsInlineSmi(node)) {
     // To prevent long attacker-controlled byte sequences in code, larger
     // Smis are loaded in two steps via a temporary register.
-    Register temp = allocator_->Allocate();
+    Result temp = allocator_->Allocate();
+    ASSERT(temp.is_valid());
     int bits = reinterpret_cast<int>(*node->handle());
-    ASSERT(!temp.is(no_reg));
-    __ mov(temp, bits & 0x0000FFFF);
-    __ xor_(temp, bits & 0xFFFF0000);
-    frame_->Push(temp);
-    allocator_->Unuse(temp);
+    __ mov(temp.reg(), bits & 0x0000FFFF);
+    __ xor_(temp.reg(), bits & 0xFFFF0000);
+    frame_->Push(&temp);

[William Hesse, 2008/12/19 08:41:03]

I thought this was in the assembler's Set() function.  Once we have constant
folding, the attacker can put a 32-bit SMI in the code by x = bad_word - 1 + 1. 
Can this be put in Set() instead?

[Kevin Millikin (Chromium), 2008/12/19 08:48:11]

Possibly, but there's probably a better way.  Ideally (once we have constant
folding :)) we will just track whether values are "contaminated" by originating
with source literals.

MacroAssembler::Set is too low-level for that.  It doesn't have any idea about
where the operand originated, and it's too late to figure it out by the time
it's called.

   } else {
     frame_->Push(node->handle());
   }