Bug 124481 – ARM64 CRASH: Improper offset in getHostCallReturnValue() to access callerFrame in CallFrame

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Michael Saboff]

In jit/JITOperations.cpp, the ARM64 version of getHostCallReturnValue() has the improper offset of -32.  It should be changed to 0.

#elif CPU(ARM64)
asm (
".text" "\n"
".align 2" "\n"
".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
HIDE_SYMBOL(getHostCallReturnValue) "\n"
SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
    "ldur x25, [x25, #-32]" "\n"   <==  This should be "ldur x25, [x25, #0]"
     "mov x0, x25" "\n"
     "b " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
);

[Andy Estes]

I'm building this change now.

[Andy Estes]

Now we're just running in to this problem in MacroAssemblerARM64.h:

    void pop(RegisterID) NO_RETURN_DUE_TO_CRASH
    {
        CRASH();
    }

    void push(RegisterID) NO_RETURN_DUE_TO_CRASH
    {
        CRASH();
    }

    void push(Address) NO_RETURN_DUE_TO_CRASH
    {
        CRASH();
    }

    void push(TrustedImm32) NO_RETURN_DUE_TO_CRASH
    {
        CRASH();
    }

Did you have a fix for this too?

[Andy Estes]

After commenting out emitPointerValidation() in ThunkGenerators.cpp, I could successfully load apple.com.

[Michael Saboff]

(In reply to comment #3)
> After commenting out emitPointerValidation() in ThunkGenerators.cpp, I could successfully load apple.com.

I'll post a patch soon.

[Michael Saboff]

Created attachment 217206 [details]
Patch

[Mark Lam]

Comment on attachment 217206 [details]
Patch

r=me

[Michael Saboff]

Committed r159428: <http://trac.webkit.org/changeset/159428>