124278 2013-11-13 06:26:51 -0800 [sh4] JavaScript engine randomly crashes 2013-11-13 09:37:35 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 jbriance webkit-unassigned commit-queue msaboff yannick.poirier oldest_to_newest 950138 0 jbriance 2013-11-13 06:26:51 -0800 This uncommon case is seen when a flushConstantPool occurs in movlMemRegCompact. As in this case a branch opcode and the constant pool are put before the movlMemRegCompact, the branch itself is patched when calling repatchCompact instead of the mov instruction, which is really bad. 950139 1 216795 jbriance 2013-11-13 06:28:21 -0800 Created attachment 216795 Protect repatchCompact from flushConstantPool in sh4 baseline JIT. 950209 2 216795 commit-queue 2013-11-13 09:37:34 -0800 Comment on attachment 216795 Protect repatchCompact from flushConstantPool in sh4 baseline JIT. Clearing flags on attachment: 216795 Committed r159203: <http://trac.webkit.org/changeset/159203> 950210 3 commit-queue 2013-11-13 09:37:35 -0800 All reviewed patches have been landed. Closing bug. 216795 2013-11-13 06:28:21 -0800 2013-11-13 09:37:34 -0800 Protect repatchCompact from flushConstantPool in sh4 baseline JIT. bug-124278.patch text/plain 2165 jbriance SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTU5MTkyKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBA CisyMDEzLTExLTEzICBKdWxpZW4gQnJpYW5jZWF1ICA8amJyaWFuY2VAY2lzY28uY29tPgorCisg ICAgICAgIFtzaDRdIFByb3RlY3QgcmVwYXRjaENvbXBhY3QgZnJvbSBmbHVzaENvbnN0YW50UG9v bC4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEyNDI3 OAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFJhbmRv bSBjcmFzaGVzIG1heSBvY2N1ciB3aXRoIHNoNCBhcmNoaXRlY3R1cmUsIHdoZW4gYSBmbHVzaENv bnN0YW50UG9vbCBvY2N1cnMgaW4KKyAgICAgICAgbW92bE1lbVJlZ0NvbXBhY3QuIEFzIGluIHRo aXMgY2FzZSBhIGJyYW5jaCBvcGNvZGUgYW5kIHRoZSBjb25zdGFudCBwb29sIGFyZSBwdXQKKyAg ICAgICAgYmVmb3JlIHRoZSBtb3ZsTWVtUmVnQ29tcGFjdCwgdGhlIGJyYW5jaCBpdHNlbGYgaXMg cGF0Y2hlZCB3aGVuIGNhbGxpbmcgcmVwYXRjaENvbXBhY3QKKyAgICAgICAgaW5zdGVhZCBvZiB0 aGUgbW92IGluc3RydWN0aW9uLCB3aGljaCBpcyByZWFsbHkgYmFkLgorCisgICAgICAgICogYXNz ZW1ibGVyL1NINEFzc2VtYmxlci5oOgorICAgICAgICAoSlNDOjpTSDRBc3NlbWJsZXI6OnJlcGF0 Y2hDb21wYWN0KTogSGFuZGxlIHRoaXMgc3BlY2lmaWMgY2FzZSBhbmQgYWRkIGFuIEFTU0VSVC4K KwogMjAxMy0xMS0xMiAgQWxleGV5IFByb3NrdXJ5YWtvdiAgPGFwQGFwcGxlLmNvbT4KIAogICAg ICAgICBEaXNhYmxlIFdlYkNyeXB0byBvbiBNb3VudGFpbiBMaW9uCkluZGV4OiBTb3VyY2UvSmF2 YVNjcmlwdENvcmUvYXNzZW1ibGVyL1NINEFzc2VtYmxlci5oCj09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJj ZS9KYXZhU2NyaXB0Q29yZS9hc3NlbWJsZXIvU0g0QXNzZW1ibGVyLmgJKHJldmlzaW9uIDE1OTE5 MikKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9hc3NlbWJsZXIvU0g0QXNzZW1ibGVyLmgJKHdv cmtpbmcgY29weSkKQEAgLTE0NjMsMTAgKzE0NjMsMTcgQEAgcHVibGljOgogCiAgICAgc3RhdGlj IHZvaWQgcmVwYXRjaENvbXBhY3Qodm9pZCogd2hlcmUsIGludDMyX3QgdmFsdWUpCiAgICAgewor ICAgICAgICB1aW50MTZfdCogaW5zdHJ1Y3Rpb25QdHIgPSByZWludGVycHJldF9jYXN0PHVpbnQx Nl90Kj4od2hlcmUpOwogICAgICAgICBBU1NFUlQodmFsdWUgPj0gMCk7CiAgICAgICAgIEFTU0VS VCh2YWx1ZSA8PSA2MCk7Ci0gICAgICAgICpyZWludGVycHJldF9jYXN0PHVpbnQxNl90Kj4od2hl cmUpID0gKCgqcmVpbnRlcnByZXRfY2FzdDx1aW50MTZfdCo+KHdoZXJlKSAmIDB4ZmZmMCkgfCAo dmFsdWUgPj4gMikpOwotICAgICAgICBjYWNoZUZsdXNoKHJlaW50ZXJwcmV0X2Nhc3Q8dWludDE2 X3QqPih3aGVyZSksIHNpemVvZih1aW50MTZfdCkpOworCisgICAgICAgIC8vIEhhbmRsZSB0aGUg dW5jb21tb24gY2FzZSB3aGVyZSBhIGZsdXNoQ29uc3RhbnRQb29sIG9jY3VyZWQgaW4gbW92bE1l bVJlZ0NvbXBhY3QuCisgICAgICAgIGlmICgoaW5zdHJ1Y3Rpb25QdHJbMF0gJiAweGYwMDApID09 IEJSQV9PUENPREUpCisgICAgICAgICAgICBpbnN0cnVjdGlvblB0ciArPSAoaW5zdHJ1Y3Rpb25Q dHJbMF0gJiAweDBmZmYpICsgMjsKKworICAgICAgICBBU1NFUlQoKGluc3RydWN0aW9uUHRyWzBd ICYgMHhmMDAwKSA9PSBNT1ZMX1JFQURfT0ZGUk1fT1BDT0RFKTsKKyAgICAgICAgaW5zdHJ1Y3Rp b25QdHJbMF0gPSAoaW5zdHJ1Y3Rpb25QdHJbMF0gJiAweGZmZjApIHwgKHZhbHVlID4+IDIpOwor ICAgICAgICBjYWNoZUZsdXNoKGluc3RydWN0aW9uUHRyLCBzaXplb2YodWludDE2X3QpKTsKICAg ICB9CiAKICAgICBzdGF0aWMgdm9pZCByZWxpbmtDYWxsKHZvaWQqIGZyb20sIHZvaWQqIHRvKQo=