Bug 153897
| Summary: | REGRESSION(192409): Cannot rely on add32() to zero-extend | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Filip Pizlo <fpizlo> |
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | ||
| Priority: | P2 | ||
| Version: | WebKit Nightly Build | ||
| Hardware: | All | ||
| OS: | All | ||
Filip Pizlo
Callers of add32() and other 32-bit arithmetic ops rely on the fact that the destination register is zero-extended. The optimizations in r192409 broke this feature, and this causes crashes on some obscure code.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Filip Pizlo
rdar://problem/24289839
Filip Pizlo
I tried writing a test, but actually hitting this issue is sooooper hard.
Filip Pizlo
Landed in http://trac.webkit.org/changeset/196152