diff options
| author | Michael Saboff <msaboff@apple.com> | 2013-03-27 10:19:03 +0100 |
|---|---|---|
| committer | The Qt Project <gerrit-noreply@qt-project.org> | 2013-03-27 11:52:13 +0100 |
| commit | 0d0b7ae573962c7777116e32644f3a66cff7c92b (patch) | |
| tree | 0b3ce6746a5543c3a02ec2b6beee9a364d68818f | |
| parent | 8d01ff3bac8724285bda5abf2c6f96e1cbdd042f (diff) | |
| download | qtwebkit-0d0b7ae573962c7777116e32644f3a66cff7c92b.tar.gz | |
Crash at JSC::call when loading www.gap.com with JSVALUE32_64 Enabled
https://bugs.webkit.org/show_bug.cgi?id=108991
Reviewed by Oliver Hunt.
Changed the restoration from calleeGPR to nonArgGPR0 because the restoration of the return location
may step on calleeGPR is it happen to be nonArgGPR2.
* dfg/DFGRepatch.cpp:
(JSC::DFG::dfgLinkClosureCall):
Change-Id: I2d27a111ae1edbfea9335f3a06c5cc53e065a673
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@141951 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
| -rw-r--r-- | Source/JavaScriptCore/dfg/DFGRepatch.cpp | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/Source/JavaScriptCore/dfg/DFGRepatch.cpp b/Source/JavaScriptCore/dfg/DFGRepatch.cpp index 07a509061..13653a647 100644 --- a/Source/JavaScriptCore/dfg/DFGRepatch.cpp +++ b/Source/JavaScriptCore/dfg/DFGRepatch.cpp @@ -1214,12 +1214,12 @@ void dfgLinkClosureCall(ExecState* exec, CallLinkInfo& callLinkInfo, CodeBlock* JITCompiler::Jump done = stubJit.jump(); slowPath.link(&stubJit); - stubJit.move(CCallHelpers::TrustedImmPtr(callLinkInfo.callReturnLocation.executableAddress()), GPRInfo::nonArgGPR2); - stubJit.restoreReturnAddressBeforeReturn(GPRInfo::nonArgGPR2); stubJit.move(calleeGPR, GPRInfo::nonArgGPR0); #if USE(JSVALUE32_64) stubJit.move(CCallHelpers::TrustedImm32(JSValue::CellTag), GPRInfo::nonArgGPR1); #endif + stubJit.move(CCallHelpers::TrustedImmPtr(callLinkInfo.callReturnLocation.executableAddress()), GPRInfo::nonArgGPR2); + stubJit.restoreReturnAddressBeforeReturn(GPRInfo::nonArgGPR2); JITCompiler::Jump slow = stubJit.jump(); LinkBuffer patchBuffer(*globalData, &stubJit, callerCodeBlock); |