Bug 150513 – REGRESSION (r179357-r179359): WebContent Crash using AOL Mail @ com.apple.JavascriptCore JSC::linkPolymorphicCall(JSC::ExecState*, JSC::CallLinkInfo&, JSC::CallVariant, JSC::RegisterPreservationMode) + 1584

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Michael Saboff]

It appears that the website is running out of stack space while making a virtual call to a Javascript function for the first time.  The call to the function properly fails due to out of stack space, but we try to add the function to a polymorphic cache and it doesn't have a CodeBlock.  linkPolymorphicCall crashes without a CodeBlock.

We need to make linkPolymorphicCall() properly handle a function without a CodeBlock.

[Michael Saboff]

rdar://problem/23097422

[Michael Saboff]

Created attachment 263954 [details]
Patch

[Saam Barati]

Comment on attachment 263954 [details]
Patch

r=me

[Benjamin Poulain]

View in context: https://bugs.webkit.org/attachment.cgi?id=263954&action=review

> Source/JavaScriptCore/jit/Repatch.cpp:686
>              // If we cannot handle a callee, assume that it's better for this whole thing to be a
>              // virtual call.

It would be good to update the comment too.

> Source/JavaScriptCore/runtime/VM.h:635
> +    bool m_failNextNewCodeBlock;

Let's use
    m_failNextNewCodeBlock { false }
then you don't need the initializer in the constructor.

> Tools/DumpRenderTree/TestRunner.cpp:1940
> +    if (argumentCount < 1)
> +        return JSValueMakeUndefined(context);
> +    

???
Do we care about argument here?

[Michael Saboff]

Committed r191530: <http://trac.webkit.org/changeset/191530>