Changeset 119647 in webkit for trunk/Source/JavaScriptCore/dfg/DFGCCallHelpers.h

Timestamp:

Jun 6, 2012, 5:23:36 PM (13 years ago)

Author:

[email protected]

Message:

DFG arguments access slow path should not crash if the arguments haven't been created
​https://bugs.webkit.org/show_bug.cgi?id=88471

Reviewed by Gavin Barraclough.

Source/JavaScriptCore:

• dfg/DFGCCallHelpers.h:

(JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
(CCallHelpers):

• dfg/DFGOperations.cpp:
• dfg/DFGOperations.h:
• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

LayoutTests:

• fast/js/dfg-arguments-out-of-bounds-expected.txt: Added.
• fast/js/dfg-arguments-out-of-bounds.html: Added.
• fast/js/dfg-inline-arguments-out-of-bounds-expected.txt: Added.
• fast/js/dfg-inline-arguments-out-of-bounds.html: Added.
• fast/js/script-tests/dfg-arguments-out-of-bounds.js: Added.

(foo.bar):
(foo):

• fast/js/script-tests/dfg-inline-arguments-out-of-bounds.js: Added.

(foo):
(bar):

File:

• trunk/Source/JavaScriptCore/dfg/DFGCCallHelpers.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGCCallHelpers.h

@@ -217 +217 @@
     }
 
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImmPtr arg2, GPRReg arg3)
+    {
+        resetCallArguments();
+        addCallArgument(GPRInfo::callFrameRegister);
+        addCallArgument(arg1);
+        addCallArgument(arg2);
+        addCallArgument(arg3);
+    }
+
     ALWAYS_INLINE void setupArgumentsWithExecState(GPRReg arg1, GPRReg arg2, GPRReg arg3, TrustedImmPtr arg4)
     {
@@ -555 +564 @@
     }
 
+    ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, TrustedImmPtr arg2, GPRReg arg3)
+    {
+        move(arg3, GPRInfo::argumentGPR3);
+        move(arg1, GPRInfo::argumentGPR1);
+        move(arg2, GPRInfo::argumentGPR2);
+        move(GPRInfo::callFrameRegister, GPRInfo::argumentGPR0);
+    }
+
     ALWAYS_INLINE void setupArgumentsWithExecState(TrustedImm32 arg1, GPRReg arg2, TrustedImm32 arg3)
     {