Somewhere between r160506 and r160522, the following statement will crash the LLINT in op_call: print(“My object: “ + { }); The following statements do NOT crash the LLINT: print(“My object: “ + 1); print(“My object: “ + “stuff”); “My object: “ + { }; The following also crashes the LLINT: var b = “My object: “ + { }; print(b);
Created attachment 219192 [details] Patch
Comment on attachment 219192 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=219192&action=review > Source/JavaScriptCore/interpreter/ProtoCallFrame.cpp:47 > - // FIXME: CStack - Align the combination of sentinel frame + callee frame > - // Maybe this should be in callToJavaScript. > - if (!(paddedArgsCount & 1)) > - paddedArgsCount++; > + // Round up paddedArgsCount to keep the stack frame size aligned. > + paddedArgsCount = WTF::roundUpToMultipleOf<2>(paddedArgsCount); Use stackAlignmentRegisters().
Committed r160562: <http://trac.webkit.org/changeset/160562>