108991 2013-02-05 16:53:25 -0800 Crash at JSC::call when loading www.gap.com with JSVALUE32_64 Enabled 2013-03-27 02:27:46 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED InRadar P2 Normal --- 106665 1 msaboff msaboff arnaud.lb oldest_to_newest 825940 0 msaboff 2013-02-05 16:53:25 -0800 Crashing on 32 bit build of JavaScriptCore in www.gap.com. Also tracked in <rdar://problem/13144376>. It appears that we are reusing a temporary register in dfgLinkClosureCall(). 825943 1 186726 msaboff 2013-02-05 17:04:42 -0800 Created attachment 186726 Patch Already reviewed by Oliver Hunt. 825946 2 msaboff 2013-02-05 17:08:30 -0800 Committed r141951: <http://trac.webkit.org/changeset/141951> 864327 3 allan.jensen 2013-03-27 02:27:46 -0700 *** Bug 106665 has been marked as a duplicate of this bug. *** 186726 2013-02-05 17:04:42 -0800 2013-02-05 17:04:42 -0800 Patch 108991.patch text/plain 1861 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTQxOTQ5KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBA CisyMDEzLTAyLTA1ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIENyYXNoIGF0IEpTQzo6Y2FsbCB3aGVuIGxvYWRpbmcgd3d3LmdhcC5jb20gd2l0aCBKU1ZB TFVFMzJfNjQgRW5hYmxlZAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1 Zy5jZ2k/aWQ9MTA4OTkxCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgT2xpdmVyIEh1bnQuCisKKyAg ICAgICAgQ2hhbmdlZCB0aGUgcmVzdG9yYXRpb24gZnJvbSBjYWxsZWVHUFIgdG8gbm9uQXJnR1BS MCBiZWNhdXNlIHRoZSByZXN0b3JhdGlvbiBvZiB0aGUgcmV0dXJuIGxvY2F0aW9uCisgICAgICAg IG1heSBzdGVwIG9uIGNhbGxlZUdQUiBpcyBpdCBoYXBwZW4gdG8gYmUgbm9uQXJnR1BSMi4KKwor ICAgICAgICAqIGRmZy9ERkdSZXBhdGNoLmNwcDoKKyAgICAgICAgKEpTQzo6REZHOjpkZmdMaW5r Q2xvc3VyZUNhbGwpOgorCiAyMDEzLTAyLTA1ICBSb2dlciBGb25nICA8cm9nZXJfZm9uZ0BhcHBs ZS5jb20+CiAKICAgICAgICAgQWRkIGEgSmF2YVNjcmlwdENvcmUgRXhwb3J0IEdlbmVyYXRvciBw cm9qZWN0LgpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdSZXBhdGNoLmNwcAo9 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1JlcGF0Y2guY3BwCShy ZXZpc2lvbiAxNDE5NDkpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1JlcGF0Y2gu Y3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xMjE1LDEyICsxMjE1LDEyIEBAIHZvaWQgZGZnTGlua0Ns b3N1cmVDYWxsKEV4ZWNTdGF0ZSogZXhlYywKICAgICBKSVRDb21waWxlcjo6SnVtcCBkb25lID0g c3R1YkppdC5qdW1wKCk7CiAgICAgCiAgICAgc2xvd1BhdGgubGluaygmc3R1YkppdCk7Ci0gICAg c3R1YkppdC5tb3ZlKENDYWxsSGVscGVyczo6VHJ1c3RlZEltbVB0cihjYWxsTGlua0luZm8uY2Fs bFJldHVybkxvY2F0aW9uLmV4ZWN1dGFibGVBZGRyZXNzKCkpLCBHUFJJbmZvOjpub25BcmdHUFIy KTsKLSAgICBzdHViSml0LnJlc3RvcmVSZXR1cm5BZGRyZXNzQmVmb3JlUmV0dXJuKEdQUkluZm86 Om5vbkFyZ0dQUjIpOwogICAgIHN0dWJKaXQubW92ZShjYWxsZWVHUFIsIEdQUkluZm86Om5vbkFy Z0dQUjApOwogI2lmIFVTRShKU1ZBTFVFMzJfNjQpCiAgICAgc3R1YkppdC5tb3ZlKENDYWxsSGVs cGVyczo6VHJ1c3RlZEltbTMyKEpTVmFsdWU6OkNlbGxUYWcpLCBHUFJJbmZvOjpub25BcmdHUFIx KTsKICNlbmRpZgorICAgIHN0dWJKaXQubW92ZShDQ2FsbEhlbHBlcnM6OlRydXN0ZWRJbW1QdHIo Y2FsbExpbmtJbmZvLmNhbGxSZXR1cm5Mb2NhdGlvbi5leGVjdXRhYmxlQWRkcmVzcygpKSwgR1BS SW5mbzo6bm9uQXJnR1BSMik7CisgICAgc3R1YkppdC5yZXN0b3JlUmV0dXJuQWRkcmVzc0JlZm9y ZVJldHVybihHUFJJbmZvOjpub25BcmdHUFIyKTsKICAgICBKSVRDb21waWxlcjo6SnVtcCBzbG93 ID0gc3R1YkppdC5qdW1wKCk7CiAgICAgCiAgICAgTGlua0J1ZmZlciBwYXRjaEJ1ZmZlcigqZ2xv YmFsRGF0YSwgJnN0dWJKaXQsIGNhbGxlckNvZGVCbG9jayk7Cg==