aboutsummaryrefslogtreecommitdiff
path: root/target/arm/translate-sve.c
diff options
context:
space:
mode:
authorRichard Henderson <richard.henderson@linaro.org>2020-07-03 16:59:43 +0100
committerPeter Maydell <peter.maydell@linaro.org>2020-07-03 16:59:43 +0100
commit4b4dc9750a0aa0b9766bd755bf6512a84744ce8a (patch)
treeff0f8c53d889055223d3834aab40dadeff562716 /target/arm/translate-sve.c
parent7fb3949d1f2365548a1d0e64e685642309029494 (diff)
target/arm: Fix temp double-free in sve ldr/str
The temp that gets assigned to clean_addr has been allocated with new_tmp_a64, which means that it will be freed at the end of the instruction. Freeing it earlier leads to assertion failure. The loop creates a complication, in which we allocate a new local temp, which does need freeing, and the final code path is shared between the loop and non-loop. Fix this complication by adding new_tmp_a64_local so that the new local temp is freed at the end, and can be treated exactly like the non-loop path. Fixes: bba87d0a0f4 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20200702175605.1987125-1-richard.henderson@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'target/arm/translate-sve.c')
-rw-r--r--target/arm/translate-sve.c8
1 files changed, 2 insertions, 6 deletions
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index f318ca265f..08f0fd15b2 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -4372,9 +4372,8 @@ static void do_ldr(DisasContext *s, uint32_t vofs, int len, int rn, int imm)
/* Copy the clean address into a local temp, live across the loop. */
t0 = clean_addr;
- clean_addr = tcg_temp_local_new_i64();
+ clean_addr = new_tmp_a64_local(s);
tcg_gen_mov_i64(clean_addr, t0);
- tcg_temp_free_i64(t0);
gen_set_label(loop);
@@ -4422,7 +4421,6 @@ static void do_ldr(DisasContext *s, uint32_t vofs, int len, int rn, int imm)
tcg_gen_st_i64(t0, cpu_env, vofs + len_align);
tcg_temp_free_i64(t0);
}
- tcg_temp_free_i64(clean_addr);
}
/* Similarly for stores. */
@@ -4463,9 +4461,8 @@ static void do_str(DisasContext *s, uint32_t vofs, int len, int rn, int imm)
/* Copy the clean address into a local temp, live across the loop. */
t0 = clean_addr;
- clean_addr = tcg_temp_local_new_i64();
+ clean_addr = new_tmp_a64_local(s);
tcg_gen_mov_i64(clean_addr, t0);
- tcg_temp_free_i64(t0);
gen_set_label(loop);
@@ -4509,7 +4506,6 @@ static void do_str(DisasContext *s, uint32_t vofs, int len, int rn, int imm)
}
tcg_temp_free_i64(t0);
}
- tcg_temp_free_i64(clean_addr);
}
static bool trans_LDR_zri(DisasContext *s, arg_rri *a)