Changeset 165426 in webkit

Timestamp:

Mar 10, 2014 9:06:31 PM (10 years ago)

Author:

mark.lam@apple.com

Message:

Crash on a stack overflow on 32-bit x86 in http/tests/websocket/tests/hybi/workers/no-onmessage-in-sync-op.html.
<​https://webkit.org/b/129955>

Reviewed by Geoffrey Garen.

The 32-bit x86 version of getHostCallReturnValue() was leaking 16 bytes
stack memory every time it was called. This is now fixed.

• jit/JITOperations.cpp:

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• jit/JITOperations.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-03-10  Mark Lam  <mark.lam@apple.com>
+
+        Crash on a stack overflow on 32-bit x86 in http/tests/websocket/tests/hybi/workers/no-onmessage-in-sync-op.html.
+        <https://webkit.org/b/129955>
+
+        Reviewed by Geoffrey Garen.
+
+        The 32-bit x86 version of getHostCallReturnValue() was leaking 16 bytes
+        stack memory every time it was called.  This is now fixed.
+
+        * jit/JITOperations.cpp:
+
 2014-03-10  Joseph Pecoraro  <pecoraro@apple.com>
 

trunk/Source/JavaScriptCore/jit/JITOperations.cpp

@@ -1831 +1831 @@
 HIDE_SYMBOL(getHostCallReturnValue) "\n"
 SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
-    "mov (%esp), %eax\n"
     "push %ebp\n"
     "leal -4(%esp), %esp\n"
     "push %ebp\n"
-    "push %eax\n"
-    "jmp " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
+    "call " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
+    "leal 8(%esp), %esp\n"
+    "pop %ebp\n"
+    "ret\n"
 );