Changeset 160221 in webkit

Timestamp:

Dec 6, 2013 6:54:06 AM (10 years ago)

Author:

msaboff@apple.com

Message:

REGRESSION(r160213): Crash in js/dom/JSON-parse.html
​https://bugs.webkit.org/show_bug.cgi?id=125335

Reviewed by Mark Lam.

Changed _llint_op_catch to materialize the VM via the scope chain instead of
the CodeBlock. CallFrames always have a scope chain, but may have a null CodeBlock.

• llint/LowLevelInterpreter32_64.asm:

(_llint_op_catch):

• llint/LowLevelInterpreter64.asm:

(_llint_op_catch):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• llint/LowLevelInterpreter32_64.asm (modified) (1 diff)
• llint/LowLevelInterpreter64.asm (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2013-12-05  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION(r160213): Crash in js/dom/JSON-parse.html
+        https://bugs.webkit.org/show_bug.cgi?id=125335
+
+        Reviewed by Mark Lam.
+
+        Changed _llint_op_catch to materialize the VM via the scope chain instead of 
+        the CodeBlock.  CallFrames always have a scope chain, but may have a null CodeBlock.
+
+        * llint/LowLevelInterpreter32_64.asm:
+        (_llint_op_catch):
+        * llint/LowLevelInterpreter64.asm:
+        (_llint_op_catch):
+
 2013-12-05  Michael Saboff  <msaboff@apple.com>
 

trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm

@@ -1983 +1983 @@
     # The throwing code must have known that we were throwing to the interpreter,
     # and have set VM::targetInterpreterPCForThrow.
-    loadp CodeBlock[cfr], t3
-    loadp CodeBlock::m_vm[t3], t3
+    loadp ScopeChain[cfr], t3
+    andp MarkedBlockMask, t3
+    loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3
     loadp VM::callFrameForThrow[t3], cfr
     loadi VM::targetInterpreterPCForThrow[t3], PC

trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

@@ -1786 +1786 @@
     # The throwing code must have known that we were throwing to the interpreter,
     # and have set VM::targetInterpreterPCForThrow.
-    loadp CodeBlock[cfr], t3
-    loadp CodeBlock::m_vm[t3], t3
+    loadp ScopeChain[cfr], t3
+    andp MarkedBlockMask, t3
+    loadp MarkedBlock::m_weakSet + WeakSet::m_vm[t3], t3
     loadp VM::callFrameForThrow[t3], cfr
     loadp CodeBlock[cfr], PB