Title: [153612] trunk/Source/_javascript_Core
- Revision
- 153612
- Author
- [email protected]
- Date
- 2013-08-01 14:57:38 -0700 (Thu, 01 Aug 2013)
Log Message
REGRESSION: Crash beneath cti_vm_throw_slowpath due to invalid CallFrame pointer
https://bugs.webkit.org/show_bug.cgi?id=119140
Reviewed by Filip Pizlo.
Ensure that ExceptionHandler is returned by functions in two registers by encoding the value as a 64 bit int.
* jit/JITExceptions.cpp:
(JSC::encode):
* jit/JITExceptions.h:
* jit/JITStubs.cpp:
(JSC::cti_vm_throw_slowpath):
* jit/JITStubs.h:
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (153611 => 153612)
--- trunk/Source/_javascript_Core/ChangeLog 2013-08-01 21:50:58 UTC (rev 153611)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-08-01 21:57:38 UTC (rev 153612)
@@ -1,3 +1,19 @@
+2013-08-01 Michael Saboff <[email protected]>
+
+ REGRESSION: Crash beneath cti_vm_throw_slowpath due to invalid CallFrame pointer
+ https://bugs.webkit.org/show_bug.cgi?id=119140
+
+ Reviewed by Filip Pizlo.
+
+ Ensure that ExceptionHandler is returned by functions in two registers by encoding the value as a 64 bit int.
+
+ * jit/JITExceptions.cpp:
+ (JSC::encode):
+ * jit/JITExceptions.h:
+ * jit/JITStubs.cpp:
+ (JSC::cti_vm_throw_slowpath):
+ * jit/JITStubs.h:
+
2013-08-01 Julien Brianceau <[email protected]>
REGRESSION(FTL): Fix sh4 implementation of ctiVMThrowTrampolineSlowpath.
Modified: trunk/Source/_javascript_Core/jit/JITExceptions.cpp (153611 => 153612)
--- trunk/Source/_javascript_Core/jit/JITExceptions.cpp 2013-08-01 21:50:58 UTC (rev 153611)
+++ trunk/Source/_javascript_Core/jit/JITExceptions.cpp 2013-08-01 21:57:38 UTC (rev 153612)
@@ -51,6 +51,13 @@
return callFrame->locationAsBytecodeOffset();
}
+EncodedExceptionHandler encode(ExceptionHandler handler)
+{
+ ExceptionHandlerUnion u;
+ u.handler = handler;
+ return u.encodedHandler;
+}
+
ExceptionHandler genericThrow(VM* vm, ExecState* callFrame, JSValue exceptionValue, unsigned vPCIndex)
{
RELEASE_ASSERT(exceptionValue);
Modified: trunk/Source/_javascript_Core/jit/JITExceptions.h (153611 => 153612)
--- trunk/Source/_javascript_Core/jit/JITExceptions.h 2013-08-01 21:50:58 UTC (rev 153611)
+++ trunk/Source/_javascript_Core/jit/JITExceptions.h 2013-08-01 21:57:38 UTC (rev 153612)
@@ -44,6 +44,17 @@
void* catchRoutine;
};
+// EncodedExceptionHandler is used to convince the compiler to return an ExceptionHander
+// struct in two registers for 32 bit builds.
+typedef int64_t EncodedExceptionHandler;
+
+union ExceptionHandlerUnion {
+ ExceptionHandler handler;
+ EncodedExceptionHandler encodedHandler;
+};
+
+EncodedExceptionHandler encode(ExceptionHandler);
+
ExceptionHandler genericThrow(VM*, ExecState*, JSValue exceptionValue, unsigned vPCIndex);
ExceptionHandler jitThrowNew(VM*, ExecState*, JSValue exceptionValue);
Modified: trunk/Source/_javascript_Core/jit/JITStubs.cpp (153611 => 153612)
--- trunk/Source/_javascript_Core/jit/JITStubs.cpp 2013-08-01 21:50:58 UTC (rev 153611)
+++ trunk/Source/_javascript_Core/jit/JITStubs.cpp 2013-08-01 21:57:38 UTC (rev 153612)
@@ -2156,11 +2156,11 @@
return handler.callFrame;
}
-ExceptionHandler JIT_STUB cti_vm_throw_slowpath(CallFrame* callFrame)
+EncodedExceptionHandler JIT_STUB cti_vm_throw_slowpath(CallFrame* callFrame)
{
VM* vm = callFrame->codeBlock()->vm();
vm->topCallFrame = callFrame;
- return jitThrowNew(vm, callFrame, vm->exception);
+ return encode(jitThrowNew(vm, callFrame, vm->exception));
}
DEFINE_STUB_FUNCTION(EncodedJSValue, to_object)
Modified: trunk/Source/_javascript_Core/jit/JITStubs.h (153611 => 153612)
--- trunk/Source/_javascript_Core/jit/JITStubs.h 2013-08-01 21:50:58 UTC (rev 153611)
+++ trunk/Source/_javascript_Core/jit/JITStubs.h 2013-08-01 21:57:38 UTC (rev 153612)
@@ -416,7 +416,7 @@
EncodedJSValue JIT_STUB cti_op_get_from_scope(STUB_ARGS_DECLARATION) WTF_INTERNAL;
void JIT_STUB cti_op_put_to_scope(STUB_ARGS_DECLARATION) WTF_INTERNAL;
-ExceptionHandler JIT_STUB cti_vm_throw_slowpath(CallFrame*) REFERENCED_FROM_ASM WTF_INTERNAL;
+EncodedExceptionHandler JIT_STUB cti_vm_throw_slowpath(CallFrame*) REFERENCED_FROM_ASM WTF_INTERNAL;
} // extern "C"
#elif ENABLE(LLINT_C_LOOP)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
