Bug 124361 - REGRESSION (r159276): rbp register overwritten in Win 64 version of callToJavascript stub
Summary: REGRESSION (r159276): rbp register overwritten in Win 64 version of callToJav...
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Other Windows 7
: P2 Normal
Assignee: Michael Saboff
Depends on:
Blocks: 116888
  Show dependency treegraph
Reported: 2013-11-14 08:52 PST by Michael Saboff
Modified: 2013-11-14 10:11 PST (History)
0 users

See Also:

Patch (1.12 KB, patch)
2013-11-14 09:01 PST, Michael Saboff
oliver: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Saboff 2013-11-14 08:52:35 PST
In the inline assembly stub for MSVC X86_64, there is an error in the instruction to save RBP:
      push rbp
=>  mov rbp, rax ; Save previous frame pointer
      mov rbp, rsp

MS inline assembly is Intel format (i.e. <opcode> <dest>, <src>, ...)  The rbp and tax need to be swapped.
Comment 1 Michael Saboff 2013-11-14 09:01:18 PST
Created attachment 216944 [details]
Comment 2 Michael Saboff 2013-11-14 10:11:15 PST
Committed r159290: <http://trac.webkit.org/changeset/159290>