- Revision
- 107338
- Author
- [email protected]
- Date
- 2012-02-09 18:26:04 -0800 (Thu, 09 Feb 2012)
Log Message
The JS Parser scope object needs a VectorTrait specialization
https://bugs.webkit.org/show_bug.cgi?id=78308
Reviewed by Gavin Barraclough.
This showed up as a periodic crash in various bits of generated code
originally, but I've added an assertion in the bytecode generator
that makes the effected code much more crash-happy should it go
wrong again.
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::resolve):
* parser/Parser.cpp:
* parser/Parser.h:
(JSC):
* runtime/JSActivation.h:
(JSC::JSActivation::isValidScopedLookup):
(JSActivation):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (107337 => 107338)
--- trunk/Source/_javascript_Core/ChangeLog 2012-02-10 02:19:55 UTC (rev 107337)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-02-10 02:26:04 UTC (rev 107338)
@@ -1,3 +1,25 @@
+2012-02-09 Oliver Hunt <[email protected]>
+
+ The JS Parser scope object needs a VectorTrait specialization
+ https://bugs.webkit.org/show_bug.cgi?id=78308
+
+ Reviewed by Gavin Barraclough.
+
+ This showed up as a periodic crash in various bits of generated code
+ originally, but I've added an assertion in the bytecode generator
+ that makes the effected code much more crash-happy should it go
+ wrong again.
+
+ * bytecompiler/BytecodeGenerator.cpp:
+ (JSC::BytecodeGenerator::BytecodeGenerator):
+ (JSC::BytecodeGenerator::resolve):
+ * parser/Parser.cpp:
+ * parser/Parser.h:
+ (JSC):
+ * runtime/JSActivation.h:
+ (JSC::JSActivation::isValidScopedLookup):
+ (JSActivation):
+
2012-02-08 Oliver Hunt <[email protected]>
Whoops, fix the build.
Modified: trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp (107337 => 107338)
--- trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp 2012-02-10 02:19:55 UTC (rev 107337)
+++ trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp 2012-02-10 02:26:04 UTC (rev 107338)
@@ -32,6 +32,7 @@
#include "BytecodeGenerator.h"
#include "BatchedTransitionOptimizer.h"
+#include "JSActivation.h"
#include "JSFunction.h"
#include "Interpreter.h"
#include "ScopeChain.h"
@@ -413,7 +414,7 @@
if (!functionBody->captures(ident))
addVar(ident, varStack[i].second & DeclarationStacks::IsConstant);
}
-
+
if (m_shouldEmitDebugHooks)
codeBlock->m_numCapturedVars = codeBlock->m_numVars;
@@ -1207,6 +1208,10 @@
return ResolveResult::dynamicIndexedGlobalResolve(entry.getIndex(), depth, currentScope, flags);
return ResolveResult::indexedGlobalResolve(entry.getIndex(), currentScope, flags);
}
+#if !ASSERT_DISABLED
+ if (JSActivation* activation = jsDynamicCast<JSActivation*>(currentVariableObject))
+ ASSERT(activation->isValidScopedLookup(entry.getIndex()));
+#endif
return ResolveResult::lexicalResolve(entry.getIndex(), depth, flags);
}
bool scopeRequiresDynamicChecks = false;
Modified: trunk/Source/_javascript_Core/parser/Parser.cpp (107337 => 107338)
--- trunk/Source/_javascript_Core/parser/Parser.cpp 2012-02-10 02:19:55 UTC (rev 107337)
+++ trunk/Source/_javascript_Core/parser/Parser.cpp 2012-02-10 02:26:04 UTC (rev 107338)
@@ -1,7 +1,7 @@
/*
* Copyright (C) 1999-2001 Harri Porten ([email protected])
* Copyright (C) 2001 Peter Kelly ([email protected])
- * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Library General Public
Modified: trunk/Source/_javascript_Core/parser/Parser.h (107337 => 107338)
--- trunk/Source/_javascript_Core/parser/Parser.h 2012-02-10 02:19:55 UTC (rev 107337)
+++ trunk/Source/_javascript_Core/parser/Parser.h 2012-02-10 02:26:04 UTC (rev 107338)
@@ -1,7 +1,7 @@
/*
* Copyright (C) 1999-2001 Harri Porten ([email protected])
* Copyright (C) 2001 Peter Kelly ([email protected])
- * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Library General Public
@@ -37,7 +37,16 @@
#include <wtf/Noncopyable.h>
#include <wtf/OwnPtr.h>
#include <wtf/RefPtr.h>
+namespace JSC {
+struct Scope;
+}
+namespace WTF {
+template <> struct VectorTraits<JSC::Scope> : SimpleClassVectorTraits {
+ static const bool canInitializeWithMemset = false; // Not all Scope data members initialize to 0.
+};
+}
+
namespace JSC {
class ExecState;
Modified: trunk/Source/_javascript_Core/runtime/JSActivation.h (107337 => 107338)
--- trunk/Source/_javascript_Core/runtime/JSActivation.h 2012-02-10 02:19:55 UTC (rev 107337)
+++ trunk/Source/_javascript_Core/runtime/JSActivation.h 2012-02-10 02:26:04 UTC (rev 107338)
@@ -75,6 +75,8 @@
static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(globalData, globalObject, proto, TypeInfo(ActivationObjectType, StructureFlags), &s_info); }
+ bool isValidScopedLookup(int index) { return index < m_numCapturedVars; }
+
protected:
void finishCreation(CallFrame*);
static const unsigned StructureFlags = IsEnvironmentRecord | OverridesGetOwnPropertySlot | OverridesVisitChildren | OverridesGetPropertyNames | JSVariableObject::StructureFlags;
