Bug 26532 - Native functions do not correctly unlink from optimised callsites when they're collected
Summary: Native functions do not correctly unlink from optimised callsites when they'r...
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.5
: P1 Normal
Assignee: Oliver Hunt
Keywords: InRadar
Depends on:
Reported: 2009-06-18 22:37 PDT by Oliver Hunt
Modified: 2009-06-19 01:02 PDT (History)
0 users

See Also:

Fixeration (19.89 KB, patch)
2009-06-18 23:17 PDT, Oliver Hunt
barraclough: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Oliver Hunt 2009-06-18 22:37:22 PDT
Native functions are not correctly unlinking from optimised callsites when they're collected, which may result in a crash if a new object is subsequently allocated at the same address, and is then called at the optimised call location.
Comment 1 Oliver Hunt 2009-06-18 23:17:55 PDT
Created attachment 31533 [details]
Comment 2 Gavin Barraclough 2009-06-18 23:38:43 PDT
Comment on attachment 31533 [details]

Please to be adding ASSERTs to check code type enum is sizeof(int32_t), and add ASSERTSs to cti_op_call_JSFunction & the arity check to the function is not a host function.

Also, in the ChangeLog you say 'Reviewed by NOBODY (OOPS!).', this should read 'Reviewed by Gavin "Viceroy of Venezuela" Barraclough.'.

Comment 3 Oliver Hunt 2009-06-19 00:11:10 PDT
Committing to http://svn.webkit.org/repository/webkit/trunk ...
	M	JavaScriptCore/ChangeLog
	M	JavaScriptCore/JavaScriptCore.exp
	M	JavaScriptCore/bytecode/CodeBlock.cpp
	M	JavaScriptCore/bytecode/CodeBlock.h
	M	JavaScriptCore/jit/JIT.cpp
	M	JavaScriptCore/jit/JITStubs.cpp
	M	JavaScriptCore/parser/Nodes.cpp
	M	JavaScriptCore/parser/Nodes.h
	M	JavaScriptCore/runtime/JSFunction.cpp
	M	JavaScriptCore/runtime/JSGlobalData.cpp
	M	JavaScriptCore/runtime/JSGlobalData.h
Committed r44844
Comment 4 David Levin 2009-06-19 01:02:24 PDT
Corresponding Windows build fix http://trac.webkit.org/changeset/44845.