Title: [112947] trunk/Source/_javascript_Core
- Revision
- 112947
- Author
- [email protected]
- Date
- 2012-04-02 14:53:12 -0700 (Mon, 02 Apr 2012)
Log Message
Activation tear-off neglects to copy the callee and scope chain, leading to crashes if we
try to create an arguments object from the activation
https://bugs.webkit.org/show_bug.cgi?id=82947
<rdar://problem/11058598>
Reviewed by Gavin Barraclough.
We now copy the entire call frame header just to be sure. This is mostly perf-netural,
except for a 3.7% slow-down in V8/earley.
* runtime/JSActivation.cpp:
(JSC::JSActivation::visitChildren):
* runtime/JSActivation.h:
(JSC::JSActivation::tearOff):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (112946 => 112947)
--- trunk/Source/_javascript_Core/ChangeLog 2012-04-02 21:44:26 UTC (rev 112946)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-04-02 21:53:12 UTC (rev 112947)
@@ -1,3 +1,20 @@
+2012-04-02 Filip Pizlo <[email protected]>
+
+ Activation tear-off neglects to copy the callee and scope chain, leading to crashes if we
+ try to create an arguments object from the activation
+ https://bugs.webkit.org/show_bug.cgi?id=82947
+ <rdar://problem/11058598>
+
+ Reviewed by Gavin Barraclough.
+
+ We now copy the entire call frame header just to be sure. This is mostly perf-netural,
+ except for a 3.7% slow-down in V8/earley.
+
+ * runtime/JSActivation.cpp:
+ (JSC::JSActivation::visitChildren):
+ * runtime/JSActivation.h:
+ (JSC::JSActivation::tearOff):
+
2012-04-02 Daniel Bates <[email protected]>
Remove Source/_javascript_Core/wtf and its empty subdirectories
Modified: trunk/Source/_javascript_Core/runtime/JSActivation.cpp (112946 => 112947)
--- trunk/Source/_javascript_Core/runtime/JSActivation.cpp 2012-04-02 21:44:26 UTC (rev 112946)
+++ trunk/Source/_javascript_Core/runtime/JSActivation.cpp 2012-04-02 21:53:12 UTC (rev 112947)
@@ -78,11 +78,15 @@
WriteBarrier<Unknown>* registerArray = thisObject->m_registerArray.get();
if (!registerArray)
return;
-
+
visitor.appendValues(registerArray, thisObject->m_numCapturedArgs);
- // Skip 'this' and call frame.
- visitor.appendValues(registerArray + CallFrame::offsetFor(thisObject->m_numCapturedArgs + 1), thisObject->m_numCapturedVars);
+ // Skip 'this' and call frame, except for callee and scope chain.
+ int offset = CallFrame::offsetFor(thisObject->m_numCapturedArgs + 1);
+ visitor.append(registerArray + offset + RegisterFile::ScopeChain);
+ visitor.append(registerArray + offset + RegisterFile::Callee);
+
+ visitor.appendValues(registerArray + offset, thisObject->m_numCapturedVars);
}
inline bool JSActivation::symbolTableGet(const Identifier& propertyName, PropertySlot& slot)
Modified: trunk/Source/_javascript_Core/runtime/JSActivation.h (112946 => 112947)
--- trunk/Source/_javascript_Core/runtime/JSActivation.h 2012-04-02 21:44:26 UTC (rev 112946)
+++ trunk/Source/_javascript_Core/runtime/JSActivation.h 2012-04-02 21:53:12 UTC (rev 112947)
@@ -127,16 +127,9 @@
OwnArrayPtr<WriteBarrier<Unknown> > registerArray = adoptArrayPtr(new WriteBarrier<Unknown>[registerArraySize]);
WriteBarrier<Unknown>* registers = registerArray.get() + registerOffset;
- // Copy all arguments that can be captured by name or by the arguments object.
- for (int i = 0; i < m_numCapturedArgs; ++i) {
- int index = CallFrame::argumentOffset(i);
- registers[index].set(globalData, this, m_registers[index].get());
- }
-
- // Skip 'this' and call frame.
-
- // Copy all captured vars.
- for (int i = 0; i < m_numCapturedVars; ++i)
+ int from = CallFrame::argumentOffset(m_numCapturedArgs - 1);
+ int to = m_numCapturedVars;
+ for (int i = from; i < to; ++i)
registers[i].set(globalData, this, m_registers[i].get());
setRegisters(registers, registerArray.release());
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
