4 ms·

OK, I'm wondering if jgrahamc is sure of why that value is being overwritten in his example... According to this document (http://developer.apple.com/mac/libra

OK, I'm wondering if jgrahamc is sure of why that value is being overwritten in his example... According to this document (http://developer.apple.com/mac/library/DOCUMENTATION/DeveloperTools/Conceptual/LowLevelABI/130-IA-32_Function_Calling_Conventions/IA32.html http://developer.apple.com/mac/library/DOCUMENTATION/Develop... ) there are 4 registers pushed onto the stack - ESI, EDI, EBX, and EBP - during a function call. Which means the attempt to write to ar[20] is actually blowing away a register saved on the stack by the function prolog, not an array allocated on the stack. Of course, I've never disassembled MacOSX code, so maybe I'm forgetting something important. If anyone can correct me, I'd be very grateful!

jgrahamc 17y ago
.text .globl _a _a: pushl %ebp movl %esp, %ebp pushl %esi subl $100, %esp call L_getpid$stub movl %eax, %ecx movl $1808407283, -92(%ebp) movl -92(%ebp), %eax imull %ecx sarl $3, %edx movl %ecx, %eax sarl $31, %eax movl %edx, %esi subl %eax, %esi movl %esi, -76(%ebp) movl -76(%ebp), %eax sall $3, %eax addl -76(%ebp), %eax addl %eax, %eax addl -76(%ebp), %eax movl %ecx, %edx subl %eax, %edx movl %edx, -76(%ebp) cmpl $0, -76(%ebp) sete %al movzbl %al, %eax movl %eax, 8(%ebp) addl $100, %esp popl %esi leave ret .globl _main _main: pushl %ebp movl %esp, %ebp subl $72, %esp movl $0, -72(%ebp) call _a movl -72(%ebp), %eax leave ret
- demallien 17y ago
  Yup, guess you're sure then ;) Though out of curiousity, have you actually looked at the stack when it's running? Also, I can see ESI and EBP being pushed onto the stack, but what's the missing third value? Update: Actually, even more intriguing, why is the stack shifted by 100 bytes for the a() function??? I would have expected it to be 72, as it was for the main() function, ie 64 bytes for the ar[16] and then 8 bytes for the two registers that are pushed onto the stack. Sigh. I'd love to actually have the time to dig out my Intel opcode books and figure it out, that would be fun, but I have to get myself back into Javascript headspace for work tomorrow morning. I wonder how many layers there are between my Javascript code and processor opcodes...
  - l0stman 17y ago
    The instruction ``call _a'' pushes the address of the next instruction onto the stack.

jgrahamc 17y ago

.text .globl _a _a: pushl %ebp movl %esp, %ebp pushl %esi subl $100, %esp call L_getpid$stub movl %eax, %ecx movl $1808407283, -92(%ebp) movl -92(%ebp), %eax imull %ecx sarl $3, %edx movl %ecx, %eax sarl $31, %eax movl %edx, %esi subl %eax, %esi movl %esi, -76(%ebp) movl -76(%ebp), %eax sall $3, %eax addl -76(%ebp), %eax addl %eax, %eax addl -76(%ebp), %eax movl %ecx, %edx subl %eax, %edx movl %edx, -76(%ebp) cmpl $0, -76(%ebp) sete %al movzbl %al, %eax movl %eax, 8(%ebp) addl $100, %esp popl %esi leave ret .globl _main _main: pushl %ebp movl %esp, %ebp subl $72, %esp movl $0, -72(%ebp) call _a movl -72(%ebp), %eax leave ret

demallien 17y ago
Yup, guess you're sure then ;) Though out of curiousity, have you actually looked at the stack when it's running? Also, I can see ESI and EBP being pushed onto the stack, but what's the missing third value? Update: Actually, even more intriguing, why is the stack shifted by 100 bytes for the a() function??? I would have expected it to be 72, as it was for the main() function, ie 64 bytes for the ar[16] and then 8 bytes for the two registers that are pushed onto the stack. Sigh. I'd love to actually have the time to dig out my Intel opcode books and figure it out, that would be fun, but I have to get myself back into Javascript headspace for work tomorrow morning. I wonder how many layers there are between my Javascript code and processor opcodes...
- l0stman 17y ago
  The instruction ``call _a'' pushes the address of the next instruction onto the stack.