Changeset 193606 in webkit for trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

Timestamp:

Dec 6, 2015, 5:54:43 PM (10 years ago)

Author:

[email protected]

Message:

REGRESSION(r193584): Causes heap use-after-free crashes in Web Inspector tests with AddressSanitizer (Requested by ddkilzer on #webkit).
​https://bugs.webkit.org/show_bug.cgi?id=151929

Reverted changeset:

"[ES6] "super" and "this" should be lexically bound inside an
arrow function and should live in a JSLexicalEnvironment"
​https://bugs.webkit.org/show_bug.cgi?id=149338
​http://trac.webkit.org/changeset/193584

File:

• trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm (modified) (2 diffs)

trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

@@ -2285 +2285 @@
     dispatch(6)
 
-
-
 _llint_op_profile_control_flow:
     traceExecution()
@@ -2292 +2290 @@
     addq 1, BasicBlockLocation::m_executionCount[t0]
     dispatch(2)
+
+
+_llint_op_load_arrowfunction_this:
+    traceExecution()
+    loadp Callee[cfr], t0
+    loadp JSArrowFunction::m_boundThis[t0], t0
+    loadisFromInstruction(1, t1)
+    storeq t0, [cfr, t1, 8]
+    dispatch(2)
+
 
 _llint_op_get_rest_length: