Changeset 173213 in webkit for trunk/Source/JavaScriptCore/ftl/FTLCompile.cpp

Timestamp:

Sep 3, 2014, 11:50:23 AM (11 years ago)

Author:

[email protected]

Message:

FTL In implementation sets callReturnLocation incorrectly leading to crashes beneath repatchCall()
​https://bugs.webkit.org/show_bug.cgi?id=136488

Reviewed by Mark Hahnenberg.

• ftl/FTLCompile.cpp:

(JSC::FTL::generateCheckInICFastPath): The call is in the slow path.

• tests/stress/ftl-in-overflow.js: Added. This used to crash with 100% with FTL enabled.

(foo):

File:

• trunk/Source/JavaScriptCore/ftl/FTLCompile.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ftl/FTLCompile.cpp

@@ -214 +214 @@
         fastPath.link(jump, slowPathBeginLoc);
 
-        CodeLocationCall callReturnLocation = fastPath.locationOf(call);
+        CodeLocationCall callReturnLocation = slowPath.locationOf(call);
 
         stubInfo.patch.deltaCallToDone = MacroAssembler::differenceBetweenCodePtr(