Closed
Bug 722955
Opened 13 years ago
Closed 13 years ago
IonMonkey: Bailouts can corrupt rectifier frames
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: dvander, Assigned: dvander)
References
Details
Attachments
(1 file)
|
(deleted),
patch
|
cdleary
:
review+
|
Details | Diff | Splinter Review |
Rectifier frames use their frame descriptor to determine how much stack space to free. However, EnsureExitFrame changes the descriptor size (necessary for stack walking), causing rectifier frames to crash on return.
bug 717297 would fix this for real, in the meantime, this patch adds a new frame type that the stack walker knows how to correct for.
|
Assignee | |
Comment 1•13 years ago
|
||
With OSI + this we can run Kraken again.
Attachment #593286 -
Flags: review?(christopher.leary)
|
||
Updated•13 years ago
|
Attachment #593286 -
Flags: review?(christopher.leary) → review+
|
|
Assignee | |
Comment 2•13 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•