Changeset 173031 in webkit for trunk/Source/JavaScriptCore/jit/JITOperations.cpp

Timestamp:

Aug 27, 2014, 4:06:00 PM (11 years ago)

Author:

[email protected]

Message:

Ensure that the call frame passed from JIT code via JSC::operationCallEval to JSC::eval always contains the valid scope chain.
​https://bugs.webkit.org/show_bug.cgi?id=136313

Patch by Akos Kiss <​[email protected]> on 2014-08-27
Reviewed by Michael Saboff.

Do not rely on calling conventions to fill in the CallerFrame component
of the execCallee parameter of JSC::operationCallEval.

• jit/JITOperations.cpp:

File:

• trunk/Source/JavaScriptCore/jit/JITOperations.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/jit/JITOperations.cpp

@@ -612 +612 @@
     execCallee->setScope(exec->scope());
     execCallee->setCodeBlock(0);
+    execCallee->setCallerFrame(exec);
 
     if (!isHostFunction(execCallee->calleeAsValue(), globalFuncEval))