|Summary:||[JSC] Polymorphic call stub's slow path should restore callee saves before performing tail call|
|Product:||WebKit||Reporter:||Yusuke Suzuki <ysuzuki>|
|Severity:||Normal||CC:||ews-watchlist, keith_miller, mark.lam, msaboff, sbarati, tzagallo, webkit-bug-importer|
|Version:||WebKit Nightly Build|
Description Yusuke Suzuki 2019-06-11 16:03:13 PDT
When linkPolymorphicCall gives up compiling polymorphic call, we fall back to virtual call. But `linkVirtualCall` does not restore the callee saves before calling the tail call, while polymorphic call does it. If the caller CodeBlock clobbers the callee saves (e.g. FTL), we forget restoring it, and caller's caller will see garbage in callee saves.
Comment 1 Yusuke Suzuki 2019-06-11 16:49:34 PDT
And polymorphic call stub's slow path seems not restoring it too.
Comment 4 Yusuke Suzuki 2019-06-11 23:31:40 PDT
The change of virtual call is not necessary. Only polymorphic call is problematic.
Comment 7 Saam Barati 2019-06-12 01:16:21 PDT
Comment 8 Saam Barati 2019-06-12 01:16:57 PDT
Comment on attachment 371935 [details] Patch r=me with comments from previous patch
Comment 9 Yusuke Suzuki 2019-06-12 13:25:50 PDT