Changeset 141536 in webkit

Timestamp:

Jan 31, 2013 9:54:04 PM (11 years ago)

Author:

ggaren@apple.com

Message:

REGRESSION (r141192): Crash beneath cti_op_get_by_id_generic @ discussions.apple.com
​https://bugs.webkit.org/show_bug.cgi?id=108576

Reviewed by Filip Pizlo.

This was a long-standing bug. The DFG would destructively reuse a register
in op_convert_this, but:

• The bug only presented during speculation failure for type Other

• The bug presented by removing the low bits of a pointer, which used to be harmless, since all objects were so aligned anyway.

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile): Don't reuse our this register as
our scratch register. The whole point of our scratch register is to
avoid destructively modifying our this register. I'm pretty sure this
was a copy-paste error.

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGSpeculativeJIT64.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2013-01-31  Geoffrey Garen  <ggaren@apple.com>
+
+        REGRESSION (r141192): Crash beneath cti_op_get_by_id_generic @ discussions.apple.com
+        https://bugs.webkit.org/show_bug.cgi?id=108576
+
+        Reviewed by Filip Pizlo.
+
+        This was a long-standing bug. The DFG would destructively reuse a register
+        in op_convert_this, but:
+
+            * The bug only presented during speculation failure for type Other
+
+            * The bug presented by removing the low bits of a pointer, which
+            used to be harmless, since all objects were so aligned anyway.
+
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile): Don't reuse our this register as
+        our scratch register. The whole point of our scratch register is to
+        avoid destructively modifying our this register. I'm pretty sure this
+        was a copy-paste error.
+
 2013-01-31  Roger Fong  <roger_fong@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@ -3806 +3806 @@
         if (isOtherSpeculation(node->child1()->prediction())) {
             JSValueOperand thisValue(this, node->child1());
-            GPRTemporary scratch(this, thisValue);
+            GPRTemporary scratch(this);
             GPRReg thisValueGPR = thisValue.gpr();
             GPRReg scratchGPR = scratch.gpr();