Changeset 119647 in webkit for trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

Timestamp:

Jun 6, 2012, 5:23:36 PM (13 years ago)

Author:

[email protected]

Message:

DFG arguments access slow path should not crash if the arguments haven't been created
​https://bugs.webkit.org/show_bug.cgi?id=88471

Reviewed by Gavin Barraclough.

Source/JavaScriptCore:

• dfg/DFGCCallHelpers.h:

(JSC::DFG::CCallHelpers::setupArgumentsWithExecState):
(CCallHelpers):

• dfg/DFGOperations.cpp:
• dfg/DFGOperations.h:
• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

LayoutTests:

• fast/js/dfg-arguments-out-of-bounds-expected.txt: Added.
• fast/js/dfg-arguments-out-of-bounds.html: Added.
• fast/js/dfg-inline-arguments-out-of-bounds-expected.txt: Added.
• fast/js/dfg-inline-arguments-out-of-bounds.html: Added.
• fast/js/script-tests/dfg-arguments-out-of-bounds.js: Added.

(foo.bar):
(foo):

• fast/js/script-tests/dfg-inline-arguments-out-of-bounds.js: Added.

(foo):
(bar):

File:

• trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@ -4028 +4028 @@
             resultGPR);
         
-        addSlowPathGenerator(
-            slowPathCall(
-                slowPath, this, operationGetArgumentByVal, resultGPR, 
-                m_jit.argumentsRegisterFor(node.codeOrigin),
-                indexGPR));
+        if (node.codeOrigin.inlineCallFrame) {
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowPath, this, operationGetInlinedArgumentByVal, resultGPR, 
+                    m_jit.argumentsRegisterFor(node.codeOrigin),
+                    node.codeOrigin.inlineCallFrame,
+                    indexGPR));
+        } else {
+            addSlowPathGenerator(
+                slowPathCall(
+                    slowPath, this, operationGetArgumentByVal, resultGPR, 
+                    m_jit.argumentsRegisterFor(node.codeOrigin),
+                    indexGPR));
+        }
         
         jsValueResult(resultGPR, m_compileIndex);