Bug 124278

Summary: [sh4] JavaScript engine randomly crashes
Product: WebKit Reporter: Julien Brianceau <jbriance>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, msaboff, yannick.poirier
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Protect repatchCompact from flushConstantPool in sh4 baseline JIT. none

Julien Brianceau
Reported 2013-11-13 06:26:51 PST
This uncommon case is seen when a flushConstantPool occurs in movlMemRegCompact. As in this case a branch opcode and the constant pool are put before the movlMemRegCompact, the branch itself is patched when calling repatchCompact instead of the mov instruction, which is really bad.
Attachments
Protect repatchCompact from flushConstantPool in sh4 baseline JIT. (2.11 KB, patch)
2013-11-13 06:28 PST, Julien Brianceau 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Julien Brianceau
Comment 1 2013-11-13 06:28:21 PST
Created attachment 216795 [details] Protect repatchCompact from flushConstantPool in sh4 baseline JIT.
WebKit Commit Bot
Comment 2 2013-11-13 09:37:34 PST
Comment on attachment 216795 [details] Protect repatchCompact from flushConstantPool in sh4 baseline JIT. Clearing flags on attachment: 216795 Committed r159203: <http://trac.webkit.org/changeset/159203>
WebKit Commit Bot
Comment 3 2013-11-13 09:37:35 PST
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.