Changeset 179035 in webkit for trunk/Source/JavaScriptCore

Timestamp:

Jan 23, 2015, 3:48:14 PM (10 years ago)

Author:

[email protected]

Message:

LayoutTests/js/script-tests/reentrant-caching.js crashing on 32 bit builds
​https://bugs.webkit.org/show_bug.cgi?id=140843

Reviewed by Oliver Hunt.

When we are in vmEntryToJavaScript, we keep the stack pointer at an
alignment sutiable for pointing to a call frame header, which is the
alignment post making a call. We adjust the sp when calling to JS code,
but don't adjust it before calling the out of stack handler.

• llint/LowLevelInterpreter32_64.asm:

Moved stack point down 8 bytes to get it aligned.

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• llint/LowLevelInterpreter32_64.asm (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2015-01-23  Michael Saboff  <[email protected]>
+
+        LayoutTests/js/script-tests/reentrant-caching.js crashing on 32 bit builds
+        https://bugs.webkit.org/show_bug.cgi?id=140843
+
+        Reviewed by Oliver Hunt.
+
+        When we are in vmEntryToJavaScript, we keep the stack pointer at an
+        alignment sutiable for pointing to a call frame header, which is the
+        alignment post making a call.  We adjust the sp when calling to JS code,
+        but don't adjust it before calling the out of stack handler.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        Moved stack point down 8 bytes to get it aligned.
+
 2015-01-23  Joseph Pecoraro  <[email protected]>
 

trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm

@@ -260 +260 @@
     end
 
+    subp 8, sp # Align stack for cCall2() to make a call.
     cCall2(_llint_throw_stack_overflow_error, vm, protoCallFrame)