Changeset 102709 in webkit for trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

Timestamp:

Dec 13, 2011, 3:17:43 PM (13 years ago)

Author:

[email protected]

Message:

Arguments object doesn't handle mutation of length property correctly
​https://bugs.webkit.org/show_bug.cgi?id=74454

Reviewed by Gavin Barraclough.

Source/JavaScriptCore:

Correct handling of arguments objects with overridden length property

• interpreter/Interpreter.cpp:

(JSC::loadVarargs):

• runtime/Arguments.cpp:

(JSC::Arguments::copyToArguments):
(JSC::Arguments::fillArgList):

LayoutTests:

Add tests of mutated arguments.length

• fast/js/arguments-expected.txt:
• fast/js/script-tests/arguments.js:

(argumentLengthIs5):
(duplicateArgumentAndReturnLast_call):
(duplicateArgumentAndReturnFirst_call):
(duplicateArgumentAndReturnLast_apply):
(duplicateArgumentAndReturnFirst_apply):

File:

• trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

@@ -496 +496 @@
         Arguments* argsObject = asArguments(arguments);
         unsigned argCount = argsObject->length(callFrame);
-        CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + firstFreeRegister + argCount + 1 + RegisterFile::CallFrameHeaderSize);
+        CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + firstFreeRegister + CallFrame::offsetFor(argCount + 1));
         if (argCount > Arguments::MaxArguments || !registerFile->grow(newCallFrame->registers())) {
             callFrame->globalData().exception = createStackOverflowError(callFrame);
@@ -510 +510 @@
         JSArray* array = asArray(arguments);
         unsigned argCount = array->length();
-        CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + firstFreeRegister + argCount + 1 + RegisterFile::CallFrameHeaderSize);
+        CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + firstFreeRegister + CallFrame::offsetFor(argCount + 1));
         if (argCount > Arguments::MaxArguments || !registerFile->grow(newCallFrame->registers())) {
             callFrame->globalData().exception = createStackOverflowError(callFrame);
@@ -523 +523 @@
     JSObject* argObject = asObject(arguments);
     unsigned argCount = argObject->get(callFrame, callFrame->propertyNames().length).toUInt32(callFrame);
-    CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + firstFreeRegister + argCount + 1 + RegisterFile::CallFrameHeaderSize);
+    CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + firstFreeRegister + CallFrame::offsetFor(argCount + 1));
     if (argCount > Arguments::MaxArguments || !registerFile->grow(newCallFrame->registers())) {
         callFrame->globalData().exception = createStackOverflowError(callFrame);