122866 2013-10-15 14:51:22 -0700 Fix 3 operand sub operation in C loop LLINT 2013-10-15 15:04:06 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 mark.lam mark.lam fpizlo ggaren mhahnenberg msaboff oliver oldest_to_newest 940138 0 mark.lam 2013-10-15 14:51:22 -0700 In LLINT asm, "sub a, b, c" means "c = a - b" , not "c = b - a". The LLINT C loop assembler was doing this wrong. This bug results in stack overflow checks not being executed after the recent stack direction inversion. Fix coming soon. 940143 1 214304 mark.lam 2013-10-15 14:55:54 -0700 Created attachment 214304 the patch. 940148 2 214304 ggaren 2013-10-15 14:57:55 -0700 Comment on attachment 214304 the patch. r=me 940150 3 mark.lam 2013-10-15 15:04:06 -0700 Thanks for the review. Landed in r157473: <http://trac.webkit.org/r157473>. 214304 2013-10-15 14:55:54 -0700 2013-10-15 14:57:55 -0700 the patch. bug-122866.patch text/plain 1518 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTU3NDcwKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEyIEBA CisyMDEzLTEwLTE1ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBG aXggMyBvcGVyYW5kIHN1YiBvcGVyYXRpb24gaW4gQyBsb29wIExMSU5ULgorICAgICAgICBodHRw czovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTIyODY2LgorCisgICAgICAgIFJl dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogb2ZmbGluZWFzbS9jbG9vcC5y YjoKKwogMjAxMy0xMC0xNSAgTWFyayBIYWhuZW5iZXJnICA8bWhhaG5lbmJlcmdAYXBwbGUuY29t PgogCiAgICAgICAgIE9iakNDYWxsYmFja0Z1bmN0aW9uSW1wbCBzaG91bGRuJ3Qgc3RvcmUgYSBK U0NvbnRleHQKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9vZmZsaW5lYXNtL2Nsb29wLnJi Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9vZmZsaW5lYXNtL2Nsb29wLnJi CShyZXZpc2lvbiAxNTc0NTgpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvb2ZmbGluZWFzbS9j bG9vcC5yYgkod29ya2luZyBjb3B5KQpAQCAtMzU2LDcgKzM1Niw3IEBAIGRlZiBjbG9vcEVtaXRP cGVyYXRpb24ob3BlcmFuZHMsIHR5cGUsIG8KICAgICByYWlzZSB1bmxlc3MgdHlwZSA9PSA6aW50 IHx8IHR5cGUgPT0gOnVpbnQgfHwgdHlwZSA9PSA6aW50MzIgfHwgdHlwZSA9PSA6dWludDMyIHx8 IFwKICAgICAgICAgdHlwZSA9PSA6aW50NjQgfHwgdHlwZSA9PSA6dWludDY0IHx8IHR5cGUgPT0g OmRvdWJsZQogICAgIGlmIG9wZXJhbmRzLnNpemUgPT0gMwotICAgICAgICAkYXNtLnB1dGMgIiN7 b3BlcmFuZHNbMl0uY2xWYWx1ZSh0eXBlKX0gPSAje29wZXJhbmRzWzFdLmNsVmFsdWUodHlwZSl9 ICN7b3BlcmF0b3J9ICN7b3BlcmFuZHNbMF0uY2xWYWx1ZSh0eXBlKX07IgorICAgICAgICAkYXNt LnB1dGMgIiN7b3BlcmFuZHNbMl0uY2xWYWx1ZSh0eXBlKX0gPSAje29wZXJhbmRzWzBdLmNsVmFs dWUodHlwZSl9ICN7b3BlcmF0b3J9ICN7b3BlcmFuZHNbMV0uY2xWYWx1ZSh0eXBlKX07IgogICAg ICAgICBpZiBvcGVyYW5kc1syXS5pc19hPyBSZWdpc3RlcklEIGFuZCAodHlwZSA9PSA6aW50MzIg b3IgdHlwZSA9PSA6dWludDMyKQogICAgICAgICAgICAgJGFzbS5wdXRjICIje29wZXJhbmRzWzJd LmNsRHVtcH0uY2xlYXJIaWdoV29yZCgpOyIgIyBKdXN0IGNsZWFyIGl0LiBJdCBkb2VzIG5vdGhp bmcgb24gdGhlIDMyLWJpdCBwb3J0LgogICAgICAgICBlbmQK