Changeset 153612 in webkit

Timestamp:

Aug 1, 2013 2:57:38 PM (11 years ago)

Author:

msaboff@apple.com

Message:

REGRESSION: Crash beneath cti_vm_throw_slowpath due to invalid CallFrame pointer
​https://bugs.webkit.org/show_bug.cgi?id=119140

Reviewed by Filip Pizlo.

Ensure that ExceptionHandler is returned by functions in two registers by encoding the value as a 64 bit int.

• jit/JITExceptions.cpp:

(JSC::encode):

• jit/JITExceptions.h:
• jit/JITStubs.cpp:

(JSC::cti_vm_throw_slowpath):

• jit/JITStubs.h:

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• jit/JITExceptions.cpp (modified) (1 diff)
• jit/JITExceptions.h (modified) (1 diff)
• jit/JITStubs.cpp (modified) (1 diff)
• jit/JITStubs.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2013-08-01  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION: Crash beneath cti_vm_throw_slowpath due to invalid CallFrame pointer
+        https://bugs.webkit.org/show_bug.cgi?id=119140
+
+        Reviewed by Filip Pizlo.
+
+        Ensure that ExceptionHandler is returned by functions in two registers by encoding the value as a 64 bit int.
+
+        * jit/JITExceptions.cpp:
+        (JSC::encode):
+        * jit/JITExceptions.h:
+        * jit/JITStubs.cpp:
+        (JSC::cti_vm_throw_slowpath):
+        * jit/JITStubs.h:
+
 2013-08-01  Julien Brianceau  <jbrianceau@nds.com>
 

trunk/Source/JavaScriptCore/jit/JITExceptions.cpp

@@ -52 +52 @@
 }
 
+EncodedExceptionHandler encode(ExceptionHandler handler)
+{
+    ExceptionHandlerUnion u;
+    u.handler = handler;
+    return u.encodedHandler;
+}
+
 ExceptionHandler genericThrow(VM* vm, ExecState* callFrame, JSValue exceptionValue, unsigned vPCIndex)
 {

trunk/Source/JavaScriptCore/jit/JITExceptions.h

@@ -45 +45 @@
 };
 
+// EncodedExceptionHandler is used to convince the compiler to return an ExceptionHander
+// struct in two registers for 32 bit builds.
+typedef int64_t EncodedExceptionHandler;
+
+union ExceptionHandlerUnion {
+    ExceptionHandler handler;
+    EncodedExceptionHandler encodedHandler;
+};
+
+EncodedExceptionHandler encode(ExceptionHandler);
+
 ExceptionHandler genericThrow(VM*, ExecState*, JSValue exceptionValue, unsigned vPCIndex);
 

trunk/Source/JavaScriptCore/jit/JITStubs.cpp

@@ -2157 +2157 @@
 }
 
-ExceptionHandler JIT_STUB cti_vm_throw_slowpath(CallFrame* callFrame)
+EncodedExceptionHandler JIT_STUB cti_vm_throw_slowpath(CallFrame* callFrame)
 {
     VM* vm = callFrame->codeBlock()->vm();
     vm->topCallFrame = callFrame;
-    return jitThrowNew(vm, callFrame, vm->exception);
+    return encode(jitThrowNew(vm, callFrame, vm->exception));
 }
 

trunk/Source/JavaScriptCore/jit/JITStubs.h

@@ -417 +417 @@
 void JIT_STUB cti_op_put_to_scope(STUB_ARGS_DECLARATION) WTF_INTERNAL;
 
-ExceptionHandler JIT_STUB cti_vm_throw_slowpath(CallFrame*) REFERENCED_FROM_ASM WTF_INTERNAL;
+EncodedExceptionHandler JIT_STUB cti_vm_throw_slowpath(CallFrame*) REFERENCED_FROM_ASM WTF_INTERNAL;
 } // extern "C"