Bug 126557 – CStack Branch: ARM64 Crash in llint_function_for_call_arity_check running 3d-raytrace.js

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Michael Saboff]

When running the sun spider test 3d-raytrace.js, we crash trying to validate the return PC in the frame after the frame was moved for arity in functionArityCheck()

    loadp CommonSlowPaths::ArityCheckData::returnPC[t1], t5
    loadp CommonSlowPaths::ArityCheckData::paddedStackSpace[t1], t0
    call t2
    if ASSERT_ENABLED
        loadp ReturnPC[cfr], t0
        loadp [t0], t0      <==== This fails due to a bad return PC value of 1.
    end

[Michael Saboff]

Created attachment 220479 [details]
Patch

[Geoffrey Garen]

Comment on attachment 220479 [details]
Patch

r=me

Would be nice to be able to assert that we match GPRInfo.

[Michael Saboff]

Committed r161407: <http://trac.webkit.org/changeset/161407>

[Michael Saboff]

(In reply to comment #2)
> (From update of attachment 220479 [details])
> r=me
> 
> Would be nice to be able to assert that we match GPRInfo.

I agree.  One thing we could do is modify the offline assembler to output some compile asserts before the inline assembly.