Changeset 173213 in webkit for trunk/Source/JavaScriptCore/ChangeLog

Timestamp:

Sep 3, 2014, 11:50:23 AM (11 years ago)

Author:

[email protected]

Message:

FTL In implementation sets callReturnLocation incorrectly leading to crashes beneath repatchCall()
​https://bugs.webkit.org/show_bug.cgi?id=136488

Reviewed by Mark Hahnenberg.

• ftl/FTLCompile.cpp:

(JSC::FTL::generateCheckInICFastPath): The call is in the slow path.

• tests/stress/ftl-in-overflow.js: Added. This used to crash with 100% with FTL enabled.

(foo):

File:

• trunk/Source/JavaScriptCore/ChangeLog (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-09-03  Filip Pizlo  <[email protected]>
+
+        FTL In implementation sets callReturnLocation incorrectly leading to crashes beneath repatchCall()
+        https://bugs.webkit.org/show_bug.cgi?id=136488
+
+        Reviewed by Mark Hahnenberg.
+
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::generateCheckInICFastPath): The call is in the slow path.
+        * tests/stress/ftl-in-overflow.js: Added. This used to crash with 100% with FTL enabled.
+        (foo):
+
 2014-09-03  Akos Kiss  <[email protected]>