Bug 43910 – The scratch register should be saved in YARR with ARM JIT

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Gabor Loki]

It looks like the scratch register (S0 == r8) is not saved before entering YARR JIT on ARM.

[Gabor Loki]

Created attachment 64215 [details]
The scratch register should be saved in YARR with ARM JIT

[Jocelyn Turcotte]

A bit of context for future reference:
This was causing a crash of QtWebKit on the N900 in release at the following stack trace:


Program received signal SIGSEGV, Segmentation fault.
JSC::RegExp::match (this=0x448ce300, s=..., startOffset=0, ovector=0x44935e58) at ../../webkit/JavaScriptCore/wtf/RefPtr.h:60
60	        T* get() const { return m_ptr; }
(gdb) bt
#0  JSC::RegExp::match (this=0x448ce300, s=..., startOffset=0, ovector=0x44935e58) at ../../webkit/JavaScriptCore/wtf/RefPtr.h:60
#1  0x412eaa70 in JSC::RegExpObject::match (this=0x44e02900, exec=0x460080c4) at ../../webkit/JavaScriptCore/runtime/RegExpConstructor.h:114
#2  0x412eae94 in JSC::RegExpObject::exec (this=0x28, exec=0x34) at ../../webkit/JavaScriptCore/runtime/RegExpObject.cpp:124
#3  0x412eb818 in regExpProtoFuncExec (exec=0x460080c4) at ../../webkit/JavaScriptCore/runtime/RegExpPrototype.cpp:75
#4  0x43fec34c in ?? ()
#5  0x43fec34c in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

[Simon Hausmann]

Comment on attachment 64215 [details]
The scratch register should be saved in YARR with ARM JIT

r=me

[Gabor Loki]

Comment on attachment 64215 [details]
The scratch register should be saved in YARR with ARM JIT

I am going to land it manually.

[Gabor Loki]

Committed revision 65242.

[Eric Seidel (no email)]

You can use webkit-patch mark-bug-fixed to get all the fancy bug updating when you chose to land without webkit-patch land or the cq.

[Simon Hausmann]

Revision r65242 cherry-picked into qtwebkit-2.1 with commit 29b5a48d43c1cca1b875c407f31fd6e1928fc0a6

[Benjamin Poulain]

Thanks Jocelyn and Loki! I will be able to work with trunk on ARM again :)