Changeset 228491 in webkit

Timestamp:

Feb 14, 2018 3:31:50 PM (6 years ago)

Author:

msaboff@apple.com

Message:

Crash: triggerOMGTierUpThunkGenerator() doesn't align the stack pointer before calling C++ code
​https://bugs.webkit.org/show_bug.cgi?id=182808

Reviewed by Keith Miller.

Set up a proper frame with a prologue and epilogue to align the stack pointer for the rest of the
thunk.

• wasm/WasmThunks.cpp:

(JSC::Wasm::triggerOMGTierUpThunkGenerator):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• wasm/WasmThunks.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-02-14  Michael Saboff  <msaboff@apple.com>
+
+        Crash: triggerOMGTierUpThunkGenerator() doesn't align the stack pointer before calling C++ code
+        https://bugs.webkit.org/show_bug.cgi?id=182808
+
+        Reviewed by Keith Miller.
+
+        Set up a proper frame with a prologue and epilogue to align the stack pointer for the rest of the
+        thunk.
+
+        * wasm/WasmThunks.cpp:
+        (JSC::Wasm::triggerOMGTierUpThunkGenerator):
+
 2018-02-14  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/wasm/WasmThunks.cpp

@@ -82 +82 @@
     CCallHelpers jit;
 
+    jit.emitFunctionPrologue();
+
     const unsigned extraPaddingBytes = 0;
     RegisterSet registersToSpill = RegisterSet::allRegisters();
     registersToSpill.exclude(RegisterSet::registersToNotSaveForCCall());
-#if CPU(ARM64)
-    // We also want to spill x30 since that holds our return pc.
-    registersToSpill.set(ARM64Registers::x30);
-#endif
     unsigned numberOfStackBytesUsedForRegisterPreservation = ScratchRegisterAllocator::preserveRegistersToStackForCall(jit, registersToSpill, extraPaddingBytes);
 
@@ -99 +97 @@
     ScratchRegisterAllocator::restoreRegistersFromStackForCall(jit, registersToSpill, RegisterSet(), numberOfStackBytesUsedForRegisterPreservation, extraPaddingBytes);
 
+    jit.emitFunctionEpilogue();
     jit.ret();
     LinkBuffer linkBuffer(jit, GLOBAL_THUNK_ID);