Changeset 102200 in webkit

Timestamp:

Dec 6, 2011, 5:29:47 PM (15 years ago)

Author:

fpizlo@apple.com

Message:

DFG 32_64 call linking does not handle non-cell callees correctly
​https://bugs.webkit.org/show_bug.cgi?id=73965

Reviewed by Sam Weinig.

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGSpeculativeJIT32_64.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-12-06  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG 32_64 call linking does not handle non-cell callees correctly
+        https://bugs.webkit.org/show_bug.cgi?id=73965
+
+        Reviewed by Sam Weinig.
+
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::emitCall):
+
 2011-12-06  Sam Weinig  <sam@webkit.org>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

@@ -1304 +1304 @@
 
     JITCompiler::DataLabelPtr targetToCheck;
-    JITCompiler::Jump slowPath;
-
-    slowPath = m_jit.branchPtrWithPatch(MacroAssembler::NotEqual, calleePayloadGPR, targetToCheck);
+    JITCompiler::JumpList slowPath;
+
+    slowPath.append(m_jit.branchPtrWithPatch(MacroAssembler::NotEqual, calleePayloadGPR, targetToCheck));
+    slowPath.append(m_jit.branch32(MacroAssembler::NotEqual, calleeTagGPR, TrustedImm32(JSValue::CellTag)));
     m_jit.loadPtr(MacroAssembler::Address(calleePayloadGPR, OBJECT_OFFSETOF(JSFunction, m_scopeChain)), resultPayloadGPR);
     m_jit.storePtr(resultPayloadGPR, payloadOfCallData(RegisterFile::ScopeChain));