Changeset 192078 in webkit for trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

Timestamp:

Nov 5, 2015, 2:21:19 PM (10 years ago)

Author:

[email protected]

Message:

Using emitResolveScope & emitGetFromScope with 'this' that is TDZ lead to segfault in DFG
​https://bugs.webkit.org/show_bug.cgi?id=150902

Patch by Aleksandr Skachkov <​[email protected]> on 2015-11-05
Reviewed by Geoffrey Garen.

Tiny fix provided by Saam Barati. This fix prevent segfault error in arrow function,
when it uses in constructor of derived class, before 'super' is called.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

File:

• trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

@@ -1826 +1826 @@
             break;
         }
-        forNode(node).makeHeapTop();
+        forNode(node).makeBytecodeTop();
         break;