Changeset 173213 in webkit for trunk/Source/JavaScriptCore

Timestamp:

Sep 3, 2014, 11:50:23 AM (11 years ago)

Author:

[email protected]

Message:

FTL In implementation sets callReturnLocation incorrectly leading to crashes beneath repatchCall()
​https://bugs.webkit.org/show_bug.cgi?id=136488

Reviewed by Mark Hahnenberg.

• ftl/FTLCompile.cpp:

(JSC::FTL::generateCheckInICFastPath): The call is in the slow path.

• tests/stress/ftl-in-overflow.js: Added. This used to crash with 100% with FTL enabled.

(foo):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• ftl/FTLCompile.cpp (modified) (1 diff)
• tests/stress/ftl-in-overflow.js (added)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-09-03  Filip Pizlo  <[email protected]>
+
+        FTL In implementation sets callReturnLocation incorrectly leading to crashes beneath repatchCall()
+        https://bugs.webkit.org/show_bug.cgi?id=136488
+
+        Reviewed by Mark Hahnenberg.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::generateCheckInICFastPath): The call is in the slow path.
+        * tests/stress/ftl-in-overflow.js: Added. This used to crash with 100% with FTL enabled.
+        (foo):
+
 2014-09-03  Akos Kiss  <[email protected]>
 

trunk/Source/JavaScriptCore/ftl/FTLCompile.cpp

@@ -214 +214 @@
         fastPath.link(jump, slowPathBeginLoc);
 
-        CodeLocationCall callReturnLocation = fastPath.locationOf(call);
+        CodeLocationCall callReturnLocation = slowPath.locationOf(call);
 
         stubInfo.patch.deltaCallToDone = MacroAssembler::differenceBetweenCodePtr(