<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>127791</bug_id>
          
          <creation_ts>2014-01-28 13:39:47 -0800</creation_ts>
          <short_desc>Arity fixup clobbers callee-saves, causing FTL-&gt;FTL arity fixed-up calls to corrupt state</short_desc>
          <delta_ts>2014-01-28 14:06:21 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          <blocked>112840</blocked>
          <everconfirmed>1</everconfirmed>
          <reporter name="Filip Pizlo">fpizlo</reporter>
          <assigned_to name="Filip Pizlo">fpizlo</assigned_to>
          <cc>barraclough</cc>
    
    <cc>ggaren</cc>
    
    <cc>mark.lam</cc>
    
    <cc>mhahnenberg</cc>
    
    <cc>mmirman</cc>
    
    <cc>msaboff</cc>
    
    <cc>nrotem</cc>
    
    <cc>oliver</cc>
    
    <cc>sam</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>973060</commentid>
    <comment_count>0</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2014-01-28 13:39:47 -0800</bug_when>
    <thetext>Patch forthcoming.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>973061</commentid>
    <comment_count>1</comment_count>
      <attachid>222479</attachid>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2014-01-28 13:40:58 -0800</bug_when>
    <thetext>Created attachment 222479
the patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>973079</commentid>
    <comment_count>2</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2014-01-28 14:06:21 -0800</bug_when>
    <thetext>Landed in http://trac.webkit.org/changeset/162958</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>222479</attachid>
            <date>2014-01-28 13:40:58 -0800</date>
            <delta_ts>2014-01-28 13:41:36 -0800</delta_ts>
            <desc>the patch</desc>
            <filename>blah.patch</filename>
            <type>text/plain</type>
            <size>5199</size>
            <attacher name="Filip Pizlo">fpizlo</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291
cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTYyOTU1KQorKysgU291cmNl
L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE5IEBA
CisyMDE0LTAxLTI4ICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg
QXJpdHkgZml4dXAgY2xvYmJlcnMgY2FsbGVlLXNhdmVzLCBjYXVzaW5nIEZUTC0+RlRMIGFyaXR5
IGZpeGVkLXVwIGNhbGxzIHRvIGNvcnJ1cHQgc3RhdGUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndl
YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEyNzc5MQorCisgICAgICAgIFJldmlld2VkIGJ5IE5P
Qk9EWSAoT09QUyEpLgorICAgICAgICAKKyAgICAgICAgTWFrZSB0aGUgNjQtYml0IHBhdGggLSBp
LmUuIHRoZSBvbmx5IHBhdGggd2hlcmUgdGhlIEZUTCBtYXR0ZXJzIC0gdXNlIHJlZ1Q2IGluc3Rl
YWQKKyAgICAgICAgb2YgcmVnVDMuIHJlZ1Q2IGlzIG5vdCBhIGNhbGxlZSBzYXZlLgorCisgICAg
ICAgICogaml0L1RodW5rR2VuZXJhdG9ycy5jcHA6CisgICAgICAgIChKU0M6OmFyaXR5Rml4dXAp
OgorICAgICAgICAqIHRlc3RzL3N0cmVzcy9mdGwtdG8tZnRsLWFyaXR5LWZpeHVwLmpzOiBBZGRl
ZC4KKyAgICAgICAgKGZvbyk6CisgICAgICAgIChiYXIpOgorCiAyMDE0LTAxLTI4ICBGaWxpcCBQ
aXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CiAKICAgICAgICAgRlRMIHNob3VsZCByZWFsbHksICpy
ZWFsbHkqIHN1cHBvcnQgTm90Q2VsbFVzZQpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2pp
dC9UaHVua0dlbmVyYXRvcnMuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29y
ZS9qaXQvVGh1bmtHZW5lcmF0b3JzLmNwcAkocmV2aXNpb24gMTYyOTUwKQorKysgU291cmNlL0ph
dmFTY3JpcHRDb3JlL2ppdC9UaHVua0dlbmVyYXRvcnMuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC00
MzUsMTUgKzQzNSwxNSBAQCBNYWNyb0Fzc2VtYmxlckNvZGVSZWYgYXJpdHlGaXh1cChWTSogdm0p
CiAjICBlbmRpZgogICAgIGppdC5sc2hpZnQzMihKU0ludGVyZmFjZUpJVDo6VHJ1c3RlZEltbTMy
KGxvZ1N0YWNrQWxpZ25tZW50UmVnaXN0ZXJzKCkpLCBKU0ludGVyZmFjZUpJVDo6cmVnVDApOwog
ICAgIGppdC5uZWc2NChKU0ludGVyZmFjZUpJVDo6cmVnVDApOwotICAgIGppdC5tb3ZlKEpTSW50
ZXJmYWNlSklUOjpjYWxsRnJhbWVSZWdpc3RlciwgSlNJbnRlcmZhY2VKSVQ6OnJlZ1QzKTsKKyAg
ICBqaXQubW92ZShKU0ludGVyZmFjZUpJVDo6Y2FsbEZyYW1lUmVnaXN0ZXIsIEpTSW50ZXJmYWNl
SklUOjpyZWdUNik7CiAgICAgaml0LmxvYWQzMihKU0ludGVyZmFjZUpJVDo6QWRkcmVzcyhKU0lu
dGVyZmFjZUpJVDo6Y2FsbEZyYW1lUmVnaXN0ZXIsIEpTU3RhY2s6OkFyZ3VtZW50Q291bnQgKiBz
aXplb2YoUmVnaXN0ZXIpKSwgSlNJbnRlcmZhY2VKSVQ6OnJlZ1QyKTsKICAgICBqaXQuYWRkMzIo
SlNJbnRlcmZhY2VKSVQ6OlRydXN0ZWRJbW0zMihKU1N0YWNrOjpDYWxsRnJhbWVIZWFkZXJTaXpl
KSwgSlNJbnRlcmZhY2VKSVQ6OnJlZ1QyKTsKIAogICAgIC8vIE1vdmUgY3VycmVudCBmcmFtZSBk
b3duIHJlZ1QwIG51bWJlciBvZiBzbG90cwogICAgIEpTSW50ZXJmYWNlSklUOjpMYWJlbCBjb3B5
TG9vcChqaXQubGFiZWwoKSk7Ci0gICAgaml0LmxvYWQ2NChKU0ludGVyZmFjZUpJVDo6cmVnVDMs
IEpTSW50ZXJmYWNlSklUOjpyZWdUMSk7Ci0gICAgaml0LnN0b3JlNjQoSlNJbnRlcmZhY2VKSVQ6
OnJlZ1QxLCBNYWNyb0Fzc2VtYmxlcjo6QmFzZUluZGV4KEpTSW50ZXJmYWNlSklUOjpyZWdUMywg
SlNJbnRlcmZhY2VKSVQ6OnJlZ1QwLCBKU0ludGVyZmFjZUpJVDo6VGltZXNFaWdodCkpOwotICAg
IGppdC5hZGRQdHIoSlNJbnRlcmZhY2VKSVQ6OlRydXN0ZWRJbW0zMig4KSwgSlNJbnRlcmZhY2VK
SVQ6OnJlZ1QzKTsKKyAgICBqaXQubG9hZDY0KEpTSW50ZXJmYWNlSklUOjpyZWdUNiwgSlNJbnRl
cmZhY2VKSVQ6OnJlZ1QxKTsKKyAgICBqaXQuc3RvcmU2NChKU0ludGVyZmFjZUpJVDo6cmVnVDEs
IE1hY3JvQXNzZW1ibGVyOjpCYXNlSW5kZXgoSlNJbnRlcmZhY2VKSVQ6OnJlZ1Q2LCBKU0ludGVy
ZmFjZUpJVDo6cmVnVDAsIEpTSW50ZXJmYWNlSklUOjpUaW1lc0VpZ2h0KSk7CisgICAgaml0LmFk
ZFB0cihKU0ludGVyZmFjZUpJVDo6VHJ1c3RlZEltbTMyKDgpLCBKU0ludGVyZmFjZUpJVDo6cmVn
VDYpOwogICAgIGppdC5icmFuY2hTdWIzMihNYWNyb0Fzc2VtYmxlcjo6Tm9uWmVybywgSlNJbnRl
cmZhY2VKSVQ6OlRydXN0ZWRJbW0zMigxKSwgSlNJbnRlcmZhY2VKSVQ6OnJlZ1QyKS5saW5rVG8o
Y29weUxvb3AsICZqaXQpOwogCiAgICAgLy8gRmlsbCBpbiByZWdUMCAtIDEgbWlzc2luZyBhcmcg
c2xvdHMgd2l0aCB1bmRlZmluZWQKQEAgLTQ1MSw4ICs0NTEsOCBAQCBNYWNyb0Fzc2VtYmxlckNv
ZGVSZWYgYXJpdHlGaXh1cChWTSogdm0pCiAgICAgaml0Lm1vdmUoSlNJbnRlcmZhY2VKSVQ6OlRy
dXN0ZWRJbW02NChWYWx1ZVVuZGVmaW5lZCksIEpTSW50ZXJmYWNlSklUOjpyZWdUMSk7CiAgICAg
aml0LmFkZDMyKEpTSW50ZXJmYWNlSklUOjpUcnVzdGVkSW1tMzIoMSksIEpTSW50ZXJmYWNlSklU
OjpyZWdUMik7CiAgICAgSlNJbnRlcmZhY2VKSVQ6OkxhYmVsIGZpbGxVbmRlZmluZWRMb29wKGpp
dC5sYWJlbCgpKTsKLSAgICBqaXQuc3RvcmU2NChKU0ludGVyZmFjZUpJVDo6cmVnVDEsIE1hY3Jv
QXNzZW1ibGVyOjpCYXNlSW5kZXgoSlNJbnRlcmZhY2VKSVQ6OnJlZ1QzLCBKU0ludGVyZmFjZUpJ
VDo6cmVnVDAsIEpTSW50ZXJmYWNlSklUOjpUaW1lc0VpZ2h0KSk7Ci0gICAgaml0LmFkZFB0cihK
U0ludGVyZmFjZUpJVDo6VHJ1c3RlZEltbTMyKDgpLCBKU0ludGVyZmFjZUpJVDo6cmVnVDMpOwor
ICAgIGppdC5zdG9yZTY0KEpTSW50ZXJmYWNlSklUOjpyZWdUMSwgTWFjcm9Bc3NlbWJsZXI6OkJh
c2VJbmRleChKU0ludGVyZmFjZUpJVDo6cmVnVDYsIEpTSW50ZXJmYWNlSklUOjpyZWdUMCwgSlNJ
bnRlcmZhY2VKSVQ6OlRpbWVzRWlnaHQpKTsKKyAgICBqaXQuYWRkUHRyKEpTSW50ZXJmYWNlSklU
OjpUcnVzdGVkSW1tMzIoOCksIEpTSW50ZXJmYWNlSklUOjpyZWdUNik7CiAgICAgaml0LmJyYW5j
aEFkZDMyKE1hY3JvQXNzZW1ibGVyOjpOb25aZXJvLCBKU0ludGVyZmFjZUpJVDo6VHJ1c3RlZElt
bTMyKDEpLCBKU0ludGVyZmFjZUpJVDo6cmVnVDIpLmxpbmtUbyhmaWxsVW5kZWZpbmVkTG9vcCwg
JmppdCk7CiAgICAgCiAgICAgLy8gQWRqdXN0IGNhbGwgZnJhbWUgcmVnaXN0ZXIgYW5kIHN0YWNr
IHBvaW50ZXIgdG8gYWNjb3VudCBmb3IgbWlzc2luZyBhcmdzCkBAIC00NjMsNyArNDYzLDcgQEAg
TWFjcm9Bc3NlbWJsZXJDb2RlUmVmIGFyaXR5Rml4dXAoVk0qIHZtKQogCiAgICAgLy8gU2F2ZSB0
aGUgb3JpZ2luYWwgcmV0dXJuIFBDLgogICAgIGppdC5sb2FkUHRyKEpTSW50ZXJmYWNlSklUOjpB
ZGRyZXNzKEpTSW50ZXJmYWNlSklUOjpjYWxsRnJhbWVSZWdpc3RlciwgQ2FsbEZyYW1lOjpyZXR1
cm5QQ09mZnNldCgpKSwgR1BSSW5mbzo6cmVnVDEpOwotICAgIGppdC5zdG9yZVB0cihHUFJJbmZv
OjpyZWdUMSwgTWFjcm9Bc3NlbWJsZXI6OkJhc2VJbmRleChKU0ludGVyZmFjZUpJVDo6cmVnVDMs
IEpTSW50ZXJmYWNlSklUOjpyZWdUMCwgSlNJbnRlcmZhY2VKSVQ6OlRpbWVzRWlnaHQpKTsKKyAg
ICBqaXQuc3RvcmVQdHIoR1BSSW5mbzo6cmVnVDEsIE1hY3JvQXNzZW1ibGVyOjpCYXNlSW5kZXgo
SlNJbnRlcmZhY2VKSVQ6OnJlZ1Q2LCBKU0ludGVyZmFjZUpJVDo6cmVnVDAsIEpTSW50ZXJmYWNl
SklUOjpUaW1lc0VpZ2h0KSk7CiAgICAgCiAgICAgLy8gSW5zdGFsbCB0aGUgbmV3IHJldHVybiBQ
Qy4KICAgICBqaXQuc3RvcmVQdHIoR1BSSW5mbzo6cmVnVDUsIEpTSW50ZXJmYWNlSklUOjpBZGRy
ZXNzKEpTSW50ZXJmYWNlSklUOjpjYWxsRnJhbWVSZWdpc3RlciwgQ2FsbEZyYW1lOjpyZXR1cm5Q
Q09mZnNldCgpKSk7CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvdGVzdHMvc3RyZXNzL2Z0
bC10by1mdGwtYXJpdHktZml4dXAuanMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRD
b3JlL3Rlc3RzL3N0cmVzcy9mdGwtdG8tZnRsLWFyaXR5LWZpeHVwLmpzCShyZXZpc2lvbiAwKQor
KysgU291cmNlL0phdmFTY3JpcHRDb3JlL3Rlc3RzL3N0cmVzcy9mdGwtdG8tZnRsLWFyaXR5LWZp
eHVwLmpzCSh3b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEsMjkgQEAKK2Z1bmN0aW9uIGZvbyhhLCBi
LCBjKSB7CisgICAgcmV0dXJuIChhfDApICsgKGJ8MCkgKyAoY3wwKTsKK30KKworZnVuY3Rpb24g
YmFyKG8pIHsKKyAgICB2YXIgYSA9IG8uZjsKKyAgICB2YXIgYiA9IG8uZzsKKyAgICB2YXIgYyA9
IG8uaDsKKyAgICB2YXIgZCA9IG8uaTsKKyAgICB2YXIgZSA9IG8uajsKKyAgICB2YXIgZiA9IG8u
azsKKyAgICB2YXIgZyA9IG8ubDsKKyAgICByZXR1cm4gZm9vKDQyKSArIGEgKyBiICsgYyArIGQg
KyBlICsgZiArIGc7Cit9CisKK25vSW5saW5lKGZvbyk7Citub0lubGluZShiYXIpOworCitmb3Ig
KHZhciBpID0gMDsgaSA8IDEwMDAwMDsgKytpKSB7CisgICAgdmFyIHJlc3VsdCA9IGJhcih7Cisg
ICAgICAgIGY6aSAqIDMsIGc6aSAtIDEsIGg6KGkgLyAyKXwwLCBpOi1pLCBqOjEzICsgKChpIC8g
NSl8MCksIGs6MTQgLSAoKGkgLyA2KXwwKSwKKyAgICAgICAgbDoxIC0gaX0pOworICAgIAorICAg
IHZhciBleHBlY3RlZCA9IDQyICsgaSAqIDMgKyBpIC0gMSArICgoaSAvIDIpfDApIC0gaSArIDEz
ICsgKChpIC8gNSl8MCkgKyAxNCAtCisgICAgICAgICgoaSAvIDYpfDApICsgMSAtIGk7CisgICAg
CisgICAgaWYgKHJlc3VsdCAhPSBleHBlY3RlZCkKKyAgICAgICAgdGhyb3cgIkVycm9yOiBmb3Ig
aXRlcmF0aW9uICIgKyBpICsgIiBleHBlY3RlZCAiICsgZXhwZWN0ZWQgKyAiIGJ1dCBnb3QgIiAr
IHJlc3VsdDsKK30K
</data>
<flag name="review"
          id="246471"
          type_id="1"
          status="+"
          setter="msaboff"
    />
          </attachment>
      

    </bug>

</bugzilla>