[Webkit-unassigned] [Bug 118798] New: DFG JIT segfaults on 32 bit systems after changing a function to an integer

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=118798

           Summary: DFG JIT segfaults on 32 bit systems after changing a
                    function to an integer
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: rgabor at webkit.org


32 bit systems are segfaulting with the following test:

function run_tests() {
    function x() {
      return 3;
    }  

    var x = 13;
    return x + x;
}

for(var i=0; i<100; ++i)
    run_tests();


The problem is that SpeculativeJIT::fillJSValue() set the jsvalue tag to cell after a NewFunction node.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.