Summary: | [Win] Javascript crash with DFG JIT enabled. | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | peavo | ||||||||
Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> | ||||||||
Status: | RESOLVED FIXED | ||||||||||
Severity: | Normal | CC: | bfulgham, commit-queue, fpizlo, ggaren, mhahnenberg, szkarlen | ||||||||
Priority: | P2 | Keywords: | PlatformOnly | ||||||||
Version: | 528+ (Nightly build) | ||||||||||
Hardware: | PC | ||||||||||
OS: | Unspecified | ||||||||||
Bug Depends on: | 120998 | ||||||||||
Bug Blocks: | |||||||||||
Attachments: |
|
Description
peavo
2013-09-08 02:00:59 PDT
Created attachment 210972 [details]
Patch
Comment on attachment 210972 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=210972&action=review > Source/JavaScriptCore/dfg/DFGThunks.cpp:56 > + jit.storeDouble(FPRInfo::toRegister(i), MacroAssembler::ImplicitAddress(GPRInfo::regT0)); Use Address not ImplicitAddres. Created attachment 211012 [details]
Patch
(In reply to comment #3) > Created an attachment (id=211012) [details] > Patch Hi! Provided patch resolves some issues, but there still crash behavior - using loops (with iteration > 100) JSC just crashes. Created attachment 214651 [details]
Patch
Upgraded the patch with changes in trunk. The same fix was also needed in dfg/DFGOSRExitCompiler32_64.cpp. I also added an assert if we try to generate code which writes to a null pointer. Comment on attachment 214651 [details]
Patch
r=me
Would be nice to make the GPRInfo::regT0 type incompatible with void*, so this became a compile error.
Comment on attachment 214651 [details] Patch Clearing flags on attachment: 214651 Committed r158057: <http://trac.webkit.org/changeset/158057> All reviewed patches have been landed. Closing bug. |