Title: [98834] trunk/Source/_javascript_Core
- Revision
- 98834
- Author
- [email protected]
- Date
- 2011-10-30 18:50:34 -0700 (Sun, 30 Oct 2011)
Log Message
JSParser::parsePrimaryExpression should have an overflow check
https://bugs.webkit.org/show_bug.cgi?id=71197
Reviewed by Geoff Garen.
* parser/JSParser.cpp:
(JSC::JSParser::parsePrimaryExpression):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (98833 => 98834)
--- trunk/Source/_javascript_Core/ChangeLog 2011-10-31 01:43:44 UTC (rev 98833)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-10-31 01:50:34 UTC (rev 98834)
@@ -1,5 +1,15 @@
2011-10-30 Filip Pizlo <[email protected]>
+ JSParser::parsePrimaryExpression should have an overflow check
+ https://bugs.webkit.org/show_bug.cgi?id=71197
+
+ Reviewed by Geoff Garen.
+
+ * parser/JSParser.cpp:
+ (JSC::JSParser::parsePrimaryExpression):
+
+2011-10-30 Filip Pizlo <[email protected]>
+
DFG ValueAdd(string, int) should not fail speculation
https://bugs.webkit.org/show_bug.cgi?id=71195
Modified: trunk/Source/_javascript_Core/parser/JSParser.cpp (98833 => 98834)
--- trunk/Source/_javascript_Core/parser/JSParser.cpp 2011-10-31 01:43:44 UTC (rev 98833)
+++ trunk/Source/_javascript_Core/parser/JSParser.cpp 2011-10-31 01:50:34 UTC (rev 98834)
@@ -2176,6 +2176,7 @@
template <class TreeBuilder> TreeExpression JSParser::parsePrimaryExpression(TreeBuilder& context)
{
+ failIfStackOverflow();
switch (m_token.m_type) {
case OPENBRACE:
if (strictMode())
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
