Changeset 193606 in webkit for trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp

Timestamp:

Dec 6, 2015, 5:54:43 PM (10 years ago)

Author:

[email protected]

Message:

REGRESSION(r193584): Causes heap use-after-free crashes in Web Inspector tests with AddressSanitizer (Requested by ddkilzer on #webkit).
​https://bugs.webkit.org/show_bug.cgi?id=151929

Reverted changeset:

"[ES6] "super" and "this" should be lexically bound inside an
arrow function and should live in a JSLexicalEnvironment"
​https://bugs.webkit.org/show_bug.cgi?id=149338
​http://trac.webkit.org/changeset/193584

File:

• trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp

@@ -668 +668 @@
     emitStoreCell(dst, regT0);
 }
+    
+void JIT::emit_op_load_arrowfunction_this(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    emitGetFromCallFrameHeaderPtr(JSStack::Callee, regT0);
+    loadPtr(Address(regT0, JSArrowFunction::offsetOfThisValue()), regT0);
+    emitStoreCell(dst, regT0);
+}
 
 void JIT::emit_op_to_this(Instruction* currentInstruction)
@@ -962 +970 @@
 void JIT::emitNewFuncExprCommon(Instruction* currentInstruction)
 {
+    OpcodeID opcodeID = m_vm->interpreter->getOpcodeID(currentInstruction->u.opcode);
+    bool isArrowFunction = opcodeID == op_new_arrow_func_exp;
+    
     Jump notUndefinedScope;
     int dst = currentInstruction[1].u.operand;
 #if USE(JSVALUE64)
     emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
+    if (isArrowFunction)
+        emitGetVirtualRegister(currentInstruction[4].u.operand, regT1);
     notUndefinedScope = branch64(NotEqual, regT0, TrustedImm64(JSValue::encode(jsUndefined())));
     store64(TrustedImm64(JSValue::encode(jsUndefined())), Address(callFrameRegister, sizeof(Register) * dst));
 #else
     emitLoadPayload(currentInstruction[2].u.operand, regT0);
+    if (isArrowFunction) {
+        int value = currentInstruction[4].u.operand;
+        emitLoad(value, regT3, regT2);
+    }
     notUndefinedScope = branch32(NotEqual, tagFor(currentInstruction[2].u.operand), TrustedImm32(JSValue::UndefinedTag));
     emitStore(dst, jsUndefined());
@@ -977 +994 @@
         
     FunctionExecutable* function = m_codeBlock->functionExpr(currentInstruction[3].u.operand);
-    OpcodeID opcodeID = m_vm->interpreter->getOpcodeID(currentInstruction->u.opcode);
-
-    if (opcodeID == op_new_func_exp || opcodeID == op_new_arrow_func_exp)
-        callOperation(operationNewFunction, dst, regT0, function);
+    if (isArrowFunction)
+#if USE(JSVALUE64)
+        callOperation(operationNewArrowFunction, dst, regT0, function, regT1);
+#else 
+        callOperation(operationNewArrowFunction, dst, regT0, function, regT3, regT2);
+#endif
     else {
-        ASSERT(opcodeID == op_new_generator_func_exp);
-        callOperation(operationNewGeneratorFunction, dst, regT0, function);
+        if (opcodeID == op_new_func_exp)
+            callOperation(operationNewFunction, dst, regT0, function);
+        else {
+            ASSERT(opcodeID == op_new_generator_func_exp);
+            callOperation(operationNewGeneratorFunction, dst, regT0, function);
+        }
     }
-
     done.link(this);
 }