Bug 147759 – jsc-tailcall: REGRESSION(r188071): Crash when handling exception in Release builds

• Status: RESOLVED
• Resolution: INVALID
• Component: JavaScriptCore

[Michael Saboff]

Looks like we are overwriting a callee save from a C++ caller.

[Michael Saboff]

Created attachment 259147 [details]
Patch

[Basile Clement]

Comment on attachment 259147 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=259147&action=review

> Source/JavaScriptCore/interpreter/Interpreter.cpp:638
> +                copyCalleeSavesToVMCalleeSavesBuffer(visitor);

Why don't we need this in the else branch?

Otherwise, LGTM.

[Michael Saboff]

Comment on attachment 259147 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=259147&action=review

>> Source/JavaScriptCore/interpreter/Interpreter.cpp:638
>> +                copyCalleeSavesToVMCalleeSavesBuffer(visitor);
> 
> Why don't we need this in the else branch?
> 
> Otherwise, LGTM.

This is the case that we found a handler, i.e. catch block, in the current frame.  We don't process that frame's callee saves.

[Michael Saboff]

Committed r188556: <http://trac.webkit.org/changeset/188556>

[Csaba Osztrogonác]

Comment on attachment 259147 [details]
Patch

Cleared review? from attachment 259147 [details] so that this bug does not appear in http://webkit.org/pending-review.  If you would like this patch reviewed, please attach it to a new bug (or re-open this bug before marking it for review again).