Crash making a tail call from a getter to a host function
https://bugs.webkit.org/show_bug.cgi?id=150663
Reviewed by Geoffrey Garen.
Source/JavaScriptCore:
Change the inline assembly versions of getHostCallReturnValue() to pass the location of the callee
call frame to getHostCallReturnValueWithExecState(). We were passing the caller's frame address.
* jit/JITOperations.cpp:
LayoutTests:
New regression tests.
* js/regress-150663-expected.txt: Added.
* js/regress-150663.html: Added.
* js/script-tests/regress-150663.js: Added.
(Test):
(Test.prototype.get sum):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@191765
268f45cc-cd09-0410-ab3c-
d52691b4dbfc