Changeset 139109 in webkit for trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h

Timestamp:

Jan 8, 2013, 2:02:04 PM (13 years ago)

Author:

[email protected]

Message:

REGRESSION (r138921): Crash in JSC::Arguments::create
​https://bugs.webkit.org/show_bug.cgi?id=106329
<rdar://problem/12974196>

Source/JavaScriptCore:

Reviewed by Mark Hahnenberg.

Arguments::finishCreation() that takes an InlineCallFrame* needs to understand that the callee can
be unset, indicating that the callee needs to be loaded from the true call frame. This adds a
method to InlineCallFrame to do just that.

• bytecode/CodeOrigin.cpp:

(JSC::InlineCallFrame::calleeForCallFrame):

• bytecode/CodeOrigin.h:

(InlineCallFrame):

• runtime/Arguments.h:

(JSC::Arguments::finishCreation):

LayoutTests:

Reviewed by Mark Hahnenberg.

• fast/js/dfg-create-inlined-arguments-in-closure-inline-expected.txt: Added.
• fast/js/dfg-create-inlined-arguments-in-closure-inline.html: Added.
• fast/js/jsc-test-list:
• fast/js/script-tests/dfg-create-inlined-arguments-in-closure-inline.js: Added.

(foo):

File:

• trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h

@@ -39 +39 @@
 
 struct InlineCallFrame;
+class ExecState;
 class ExecutableBase;
 class JSFunction;
@@ -111 +112 @@
     bool isClosureCall() const { return !callee; }
     
+    // Get the callee given a machine call frame to which this InlineCallFrame belongs.
+    JSFunction* calleeForCallFrame(ExecState*) const;
+    
     String inferredName() const;
     CodeBlockHash hash() const;