Commit 592ad6dc authored by jkummerow's avatar jkummerow Committed by Commit bot

[x64] Fix crashes in CheckAccessGlobalProxy

We have to do a Smi check on the frame marker, not just compare
against a single frame type.

BUG=chromium:593332
LOG=n
TBR=danno@chromium.org

Review URL: https://codereview.chromium.org/1777913002

Cr-Commit-Position: refs/heads/master@{#34625}
parent 52a741d1
...@@ -4579,10 +4579,9 @@ void MacroAssembler::CheckAccessGlobalProxy(Register holder_reg, ...@@ -4579,10 +4579,9 @@ void MacroAssembler::CheckAccessGlobalProxy(Register holder_reg,
movp(scratch, rbp); movp(scratch, rbp);
bind(&load_context); bind(&load_context);
DCHECK(SmiValuesAre32Bits()); DCHECK(SmiValuesAre32Bits());
int smi_tag_offset = kSmiShift / kBitsPerByte; // This is "JumpIfNotSmi" but without loading the value into a register.
cmpl(MemOperand(scratch, CommonFrameConstants::kContextOrFrameTypeOffset + cmpl(MemOperand(scratch, CommonFrameConstants::kContextOrFrameTypeOffset),
smi_tag_offset), Immediate(0));
Immediate(StackFrame::STUB));
j(not_equal, &has_context); j(not_equal, &has_context);
movp(scratch, MemOperand(scratch, CommonFrameConstants::kCallerFPOffset)); movp(scratch, MemOperand(scratch, CommonFrameConstants::kCallerFPOffset));
jmp(&load_context); jmp(&load_context);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment