In the JSStack constructor, m_commitEnd is initialized to highAddress() which is the address just above the start of the stack. This is appropriate because no memory has been committed for the stack yet i.e. highAddress() - m_commitEnd should equal 0. When we grow the stack in growSlowCase, we set m_commitEnd to m_commitEnd - delta, where delta is some even multiple of commitSize (some units of page size). This means that if there is memory committed, m_commitEnd would point to an allocatable slot in the stack, not past it. Hence, m_commitEnd should more appropriately be named m_commitTop.
Created attachment 219937 [details] the patch.
Created attachment 219938
Landed in r161030 on the jsCStack branch: <http://trac.webkit.org/r161030>.
Comment on attachment 219937 [details] the patch. r=me
Thanks. Review status updated in r161934 on the jsCStack branch: <http://trac.webkit.org/r161934>.