<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:fpizlo@apple.com" title="Filip Pizlo <fpizlo@apple.com>"> <span class="fn">Filip Pizlo</span></a>
</span> changed
<a class="bz_bug_link
bz_status_NEW "
title="NEW - JSC is crashing on release mode when running exit-from-setter.js when compiled with MSVC"
href="https://bugs.webkit.org/show_bug.cgi?id=164351">bug 164351</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">Attachment #295747 Flags</td>
<td>
</td>
<td>review-
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - JSC is crashing on release mode when running exit-from-setter.js when compiled with MSVC"
href="https://bugs.webkit.org/show_bug.cgi?id=164351#c4">Comment # 4</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - JSC is crashing on release mode when running exit-from-setter.js when compiled with MSVC"
href="https://bugs.webkit.org/show_bug.cgi?id=164351">bug 164351</a>
from <span class="vcard"><a class="email" href="mailto:fpizlo@apple.com" title="Filip Pizlo <fpizlo@apple.com>"> <span class="fn">Filip Pizlo</span></a>
</span></b>
<pre>Comment on <span class=""><a href="attachment.cgi?id=295747&action=diff" name="attach_295747" title="Patch">attachment 295747</a> <a href="attachment.cgi?id=295747&action=edit" title="Patch">[details]</a></span>
Patch
View in context: <a href="https://bugs.webkit.org/attachment.cgi?id=295747&action=review">https://bugs.webkit.org/attachment.cgi?id=295747&action=review</a>
Please investigate why the stack pointer was not set correctly in the first place.
<span class="quote">> Source/JavaScriptCore/ChangeLog:13
> + What appears to have been going on was that an inline multiplication is attempted to be done in
> + DFG jit which overflows and returns to baseline jit where the access stub is later called.
> + When the access stub is called, the stack pointer hasn't been set up properly so that when it
> + is restored with lea -0xXX(%rbp), %rsp, the stack pointer becomes misaligned and</span >
An intended invariant of JSC is that the stack pointer is set correctly at every baseline JIT bytecode instruction boundary. This implies that the bug here is that the DFG JIT is not setting the stack pointer to the appropriate height.
<span class="quote">> Source/JavaScriptCore/ChangeLog:17
> + There doesn't seem to be a place where the stack pointer is supposed to be set up before this
> + call. This change sets up the stack pointer before saves based on what is expected in
> + PolymorphicAccess.cpp:1104</span >
There is such a place. What you are describing sounds like a fundamental OSR exit bug, and your fix is a very weak workaround at best. Many more things depend on the stack pointer being set right, not just PolymorphicAccess.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>