Bug 125694 – jsCStack:REGRESSION: "print(“My object: “ + { });” crashes LLINT in op_call

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Mark Lam]

Somewhere between r160506 and r160522, the following statement will crash the LLINT in op_call:

    print(“My object: “ + { });

The following statements do NOT crash the LLINT:

    print(“My object: “ + 1);

    print(“My object: “ + “stuff”);

    “My object: “ + { };

The following also crashes the LLINT:

    var b = “My object: “ + { };
    print(b);

[Michael Saboff]

Created attachment 219192 [details]
Patch

[Filip Pizlo]

Comment on attachment 219192 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=219192&action=review

> Source/JavaScriptCore/interpreter/ProtoCallFrame.cpp:47
> -    // FIXME: CStack - Align the combination of sentinel frame + callee frame
> -    // Maybe this should be in callToJavaScript.
> -    if (!(paddedArgsCount & 1))
> -        paddedArgsCount++;
> +    // Round up paddedArgsCount to keep the stack frame size aligned.
> +    paddedArgsCount = WTF::roundUpToMultipleOf<2>(paddedArgsCount);

Use stackAlignmentRegisters().

[Michael Saboff]

Committed r160562: <http://trac.webkit.org/changeset/160562>