Changeset 34017 in webkit for trunk/JavaScriptCore/kjs/nodes.cpp

Timestamp:

May 22, 2008, 1:17:38 AM (17 years ago)

Author:

[email protected]

Message:

JavaScriptCore:

2008-05-22 Maciej Stachowiak <​[email protected]>

Reviewed by Oliver.

• fixed <rdar://problem/5954979> crash on celtic kane JS benchmark

• kjs/nodes.cpp: (KJS::WithNode::emitCode): (KJS::TryNode::emitCode):

LayoutTests:

2008-05-22 Maciej Stachowiak <​[email protected]>

Reviewed by Oliver.

• test case for <rdar://problem/5954979> crash on celtic kane JS benchmark

• fast/js/try-catch-crash-expected.txt: Added.
• fast/js/try-catch-crash.html: Added.

File:

• trunk/JavaScriptCore/kjs/nodes.cpp (modified) (2 diffs)

trunk/JavaScriptCore/kjs/nodes.cpp

@@ -5396 +5396 @@
 RegisterID* WithNode::emitCode(CodeGenerator& generator, RegisterID* dst)
 {
-    RegisterID* scope = generator.emitNode(m_expr.get());
-    generator.emitPushScope(scope);
+    RefPtr<RegisterID> scope = generator.emitNode(m_expr.get()); // scope must be protected until popped
+    generator.emitPushScope(scope.get());
     RegisterID* result = generator.emitNode(dst, m_statement.get());
     generator.emitPopScope();
@@ -5685 +5685 @@
         generator.emitJump(handlerEndLabel.get());
         RefPtr<RegisterID> exceptionRegister = generator.emitCatch(generator.newTemporary(), tryStartLabel.get(), tryEndLabel.get());
-        RegisterID* newScope = generator.emitNewObject(generator.newTemporary());
-        generator.emitPutById(newScope, m_exceptionIdent, exceptionRegister.get());
+        RefPtr<RegisterID> newScope = generator.emitNewObject(generator.newTemporary()); // scope must be protected until popped
+        generator.emitPutById(newScope.get(), m_exceptionIdent, exceptionRegister.get());
         exceptionRegister = 0; // Release register used for temporaries
-        generator.emitPushScope(newScope);
+        generator.emitPushScope(newScope.get());
         generator.emitNode(dst, m_catchBlock.get());
         generator.emitPopScope();