Changeset 202838 in webkit
- Timestamp:
- Jul 5, 2016 4:09:51 PM (8 years ago)
- Location:
- trunk/Source/JavaScriptCore
- Files:
-
- 1 added
- 2 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/Source/JavaScriptCore/ChangeLog
r202832 r202838 1 2016-07-05 Geoffrey Garen <ggaren@apple.com> 2 3 Crash @ bankofamerica.com, University of Vienna 4 https://bugs.webkit.org/show_bug.cgi?id=159439 5 6 Reviewed by Saam Barati. 7 8 * ftl/FTLLink.cpp: 9 (JSC::FTL::link): Do check for stack overflow in the arity mismatch thunk 10 because it can happen. Don't store a CallSiteIndex because we haven't 11 stored a CodeBlock yet, and our stack frame is not fully constructed, 12 so it would be an error for any client to try to load this value (and 13 operationCallArityCheck does not load this value). 14 15 * tests/stress/arity-check-ftl-throw.js: Added. New test case for stressing 16 a stack overflow with arity mismatch. Sadly, after hours of fiddling, I 17 can't seem to get this to fail in trunk. Still, it's good to have some 18 more testing in this area. 19 1 20 2016-07-05 Benjamin Poulain <bpoulain@apple.com> 2 21 -
trunk/Source/JavaScriptCore/ftl/FTLLink.cpp
r196756 r202838 138 138 jit.emitFunctionPrologue(); 139 139 jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0); 140 jit.store32(141 CCallHelpers::TrustedImm32(CallSiteIndex(0).bits()),142 CCallHelpers::tagFor(JSStack::ArgumentCount));143 140 jit.storePtr(GPRInfo::callFrameRegister, &vm.topCallFrame); 144 141 CCallHelpers::Call callArityCheck = jit.call(); 142 143 auto noException = jit.branch32(CCallHelpers::AboveOrEqual, GPRInfo::returnValueGPR, CCallHelpers::TrustedImm32(0)); 144 jit.copyCalleeSavesToVMEntryFrameCalleeSavesBuffer(); 145 jit.move(CCallHelpers::TrustedImmPtr(jit.vm()), GPRInfo::argumentGPR0); 146 jit.move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR1); 147 CCallHelpers::Call callLookupExceptionHandlerFromCallerFrame = jit.call(); 148 jit.jumpToExceptionHandler(); 149 noException.link(&jit); 150 145 151 #if !ASSERT_DISABLED 146 // FIXME: need to make this call register with exception handling somehow. This is147 // part of a bigger problem: FTL should be able to handle exceptions.148 // https://bugs.webkit.org/show_bug.cgi?id=113622149 // Until then, use a JIT ASSERT.150 152 jit.load64(vm.addressOfException(), GPRInfo::regT1); 151 153 jit.jitAssertIsNull(GPRInfo::regT1); 152 154 #endif 155 153 156 jit.move(GPRInfo::returnValueGPR, GPRInfo::argumentGPR0); 154 157 jit.emitFunctionEpilogue(); … … 165 168 } 166 169 linkBuffer->link(callArityCheck, codeBlock->m_isConstructor ? operationConstructArityCheck : operationCallArityCheck); 170 linkBuffer->link(callLookupExceptionHandlerFromCallerFrame, lookupExceptionHandlerFromCallerFrame); 167 171 linkBuffer->link(callArityFixup, FunctionPtr((vm.getCTIStub(arityFixupGenerator)).code().executableAddress())); 168 172 linkBuffer->link(mainPathJumps, CodeLocationLabel(bitwise_cast<void*>(state.generatedFunction)));
Note: See TracChangeset
for help on using the changeset viewer.