Changeset 214040 in webkit for trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp

Timestamp:

Mar 16, 2017, 6:24:46 AM (8 years ago)

Author:

Yusuke Suzuki

Message:

Unreviewed, fix numParameter() - 1 OSRExit materialization
​https://bugs.webkit.org/show_bug.cgi?id=164582

When materializing rest parameters, we rely on that numParameter() - 1 equals to
the numberOfArgumentsToSkip. But this assumption is broken in r214029.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::finishCreation):

• bytecode/CodeBlock.h:

(JSC::CodeBlock::numberOfArgumentsToSkip):

• ftl/FTLOperations.cpp:

(JSC::FTL::operationMaterializeObjectInOSR):

File:

• trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp

@@ -265 +265 @@
                     materialization->origin(), exec->codeBlock());
 
-                unsigned numberOfArgumentsToSkip = codeBlock->numParameters() - 1;
+                unsigned numberOfArgumentsToSkip = codeBlock->numberOfArgumentsToSkip();
                 JSGlobalObject* globalObject = codeBlock->globalObject();
                 Structure* structure = globalObject->restParameterStructure();
@@ -359 +359 @@
         }
         case PhantomCreateRest: {
-            unsigned numberOfArgumentsToSkip = codeBlock->numParameters() - 1;
+            unsigned numberOfArgumentsToSkip = codeBlock->numberOfArgumentsToSkip();
             JSGlobalObject* globalObject = codeBlock->globalObject();
             Structure* structure = globalObject->restParameterStructure();