[Webkit-unassigned] [Bug 119140] REGRESSION: Crash beneath cti_vm_throw_slowpath due to invalid CallFrame pointer

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=119140





--- Comment #24 from Michael Saboff <msaboff at apple.com>  2013-08-01 08:39:55 PST ---
(In reply to comment #21)
> (In reply to comment #17)
> > (In reply to comment #16)
> > > Julien and I discovered the problem here:
> > > 
> > > ExceptionHandler __attribute__ ((fastcall)) cti_vm_throw_slowpath(CallFrame* callFrame);
> > > 
> > > On some compilers, returning a struct causes the compiler to allocate the first register as the "pointer to return value".
> > 
> > Makes sense.  I was looking at the disassembly that Julien posted and the use of %ecx was throwing me.  The first arg (callFrame) was in %edx.
> > 
> > That means that ctiVMThrowTrampolineSlowpath will need to be modified for those compilers to allocate the struct space on the stack and put the address in %ecx, put callFrame in %edx and then on return use the values in the stack instead of %eax:edx
> > 
> > Did you determine any predefined macros that say the compiler is doing this?
> 
> I believe that is the standard System V ABI on x86, which is implemented by Linux, Mac OS X (not that 32-bit matters here I suppose :) and other Unixy variants . See also "Functions Returning Structures or Unions" in http://sco.com/developers/devspecs/abi386-4.pdf
> 
> The invisible pointer-to-returned-structure argument that's normally on the stack indeed moves into the first register then.
> 
> On Windows on the other hand the structure in this case (which is 8 bytes) is returned in an eax:edx pair, if it fits
> ( http://msdn.microsoft.com/en-us/library/984x0h58.aspx )

Clang on MacOSX also passes an 8 byte structure in eax:edx.  That is why this isn't an issue on 32 bit Mac builds.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.