diff options
author | Rich Felker <dalias@aerifal.cx> | 2019-08-05 18:41:47 -0400 |
---|---|---|
committer | Rich Felker <dalias@aerifal.cx> | 2019-08-05 18:41:47 -0400 |
commit | f3ed8bfe8a82af1870ddc8696ed4cc1d5aa6b441 (patch) | |
tree | 4b419cdf7843dd8f34a4c33bfe8391491b6e65e3 /src/math | |
parent | 244778f70cecdb08302e47cfe412e8e186113444 (diff) | |
download | musl-f3ed8bfe8a82af1870ddc8696ed4cc1d5aa6b441.zip musl-f3ed8bfe8a82af1870ddc8696ed4cc1d5aa6b441.tar.gz musl-f3ed8bfe8a82af1870ddc8696ed4cc1d5aa6b441.tar.bz2 |
fix x87 stack imbalance in corner cases of i386 math asm
commit 31c5fb80b9eae86f801be4f46025bc6532a554c5 introduced underflow
code paths for the i386 math asm, along with checks on the fpu status
word to skip the underflow-generation instructions if the underflow
flag was already raised. unfortunately, at least one such path, in
log1p, returned with 2 items on the x87 stack rather than just 1 item
for the return value. this is a violation of the ABI's calling
convention, and could cause subsequent floating point code to produce
NANs due to x87 stack overflow. if floating point results are used in
flow control, this can lead to runaway wrong code execution.
rather than reviewing each "underflow already raised" code path for
correctness, remove them all. they're likely slower than just
performing the underflow code unconditionally, and significantly more
complex.
all of this code should be ripped out and replaced by C source files
with inline asm. doing so would preclude this kind of error by having
the compiler perform all x87 stack register allocation and stack
manipulation, and would produce comparable or better code. however
such a change is a much larger project.
Diffstat (limited to 'src/math')
-rw-r--r-- | src/math/i386/asin.s | 10 | ||||
-rw-r--r-- | src/math/i386/atan.s | 7 | ||||
-rw-r--r-- | src/math/i386/atan2.s | 5 | ||||
-rw-r--r-- | src/math/i386/atan2f.s | 5 | ||||
-rw-r--r-- | src/math/i386/atanf.s | 7 | ||||
-rw-r--r-- | src/math/i386/exp.s | 10 | ||||
-rw-r--r-- | src/math/i386/log1p.s | 7 | ||||
-rw-r--r-- | src/math/i386/log1pf.s | 7 |
8 files changed, 14 insertions, 44 deletions
diff --git a/src/math/i386/asin.s b/src/math/i386/asin.s index a9f691b..920d967 100644 --- a/src/math/i386/asin.s +++ b/src/math/i386/asin.s @@ -7,13 +7,10 @@ asinf: cmp $0x01000000,%eax jae 1f # subnormal x, return x with underflow - fnstsw %ax - and $16,%ax - jnz 2f fld %st(0) fmul %st(1) fstps 4(%esp) -2: ret + ret .global asinl .type asinl,@function @@ -30,11 +27,8 @@ asin: cmp $0x00200000,%eax jae 1f # subnormal x, return x with underflow - fnstsw %ax - and $16,%ax - jnz 2f fsts 4(%esp) -2: ret + ret 1: fld %st(0) fld1 fsub %st(0),%st(1) diff --git a/src/math/i386/atan.s b/src/math/i386/atan.s index d73137b..a26feae 100644 --- a/src/math/i386/atan.s +++ b/src/math/i386/atan.s @@ -10,8 +10,5 @@ atan: fpatan ret # subnormal x, return x with underflow -1: fnstsw %ax - and $16,%ax - jnz 2f - fsts 4(%esp) -2: ret +1: fsts 4(%esp) + ret diff --git a/src/math/i386/atan2.s b/src/math/i386/atan2.s index a7d2979..1fa0524 100644 --- a/src/math/i386/atan2.s +++ b/src/math/i386/atan2.s @@ -10,8 +10,5 @@ atan2: cmp $0x00200000,%eax jae 1f # subnormal x, return x with underflow - fnstsw %ax - and $16,%ax - jnz 1f fsts 4(%esp) -1: ret + ret diff --git a/src/math/i386/atan2f.s b/src/math/i386/atan2f.s index 14b88ce..0b26472 100644 --- a/src/math/i386/atan2f.s +++ b/src/math/i386/atan2f.s @@ -10,10 +10,7 @@ atan2f: cmp $0x01000000,%eax jae 1f # subnormal x, return x with underflow - fnstsw %ax - and $16,%ax - jnz 1f fld %st(0) fmul %st(1) fstps 4(%esp) -1: ret + ret diff --git a/src/math/i386/atanf.s b/src/math/i386/atanf.s index 8caddef..893beac 100644 --- a/src/math/i386/atanf.s +++ b/src/math/i386/atanf.s @@ -10,10 +10,7 @@ atanf: fpatan ret # subnormal x, return x with underflow -1: fnstsw %ax - and $16,%ax - jnz 2f - fld %st(0) +1: fld %st(0) fmul %st(1) fstps 4(%esp) -2: ret + ret diff --git a/src/math/i386/exp.s b/src/math/i386/exp.s index c7aa5b6..df87c49 100644 --- a/src/math/i386/exp.s +++ b/src/math/i386/exp.s @@ -7,13 +7,10 @@ expm1f: cmp $0x01000000,%eax jae 1f # subnormal x, return x with underflow - fnstsw %ax - and $16,%ax - jnz 2f fld %st(0) fmul %st(1) fstps 4(%esp) -2: ret + ret .global expm1l .type expm1l,@function @@ -30,11 +27,8 @@ expm1: cmp $0x00200000,%eax jae 1f # subnormal x, return x with underflow - fnstsw %ax - and $16,%ax - jnz 2f fsts 4(%esp) -2: ret + ret 1: fldl2e fmulp mov $0xc2820000,%eax diff --git a/src/math/i386/log1p.s b/src/math/i386/log1p.s index 6b6929c..354f391 100644 --- a/src/math/i386/log1p.s +++ b/src/math/i386/log1p.s @@ -16,9 +16,6 @@ log1p: fyl2x ret # subnormal x, return x with underflow -2: fnstsw %ax - and $16,%ax - jnz 1f - fsts 4(%esp) +2: fsts 4(%esp) fstp %st(1) -1: ret + ret diff --git a/src/math/i386/log1pf.s b/src/math/i386/log1pf.s index c0bcd30..4d3484c 100644 --- a/src/math/i386/log1pf.s +++ b/src/math/i386/log1pf.s @@ -16,10 +16,7 @@ log1pf: fyl2x ret # subnormal x, return x with underflow -2: fnstsw %ax - and $16,%ax - jnz 1f - fxch +2: fxch fmul %st(1) fstps 4(%esp) -1: ret + ret |