Changeset 34751 in webkit for trunk/JavaScriptCore/VM/Machine.cpp

Timestamp:

Jun 23, 2008, 5:19:25 PM (17 years ago)

Author:

[email protected]

Message:

2008-06-23 Cameron Zwarich <​[email protected]>

Reviewed by Oliver.

Bug 19716: REGRESSION (SquirrelFish): Reproducible crash after entering a username at mint.com
<​https://bugs.webkit.org/show_bug.cgi?id=19716>

When unwinding callframes for exceptions, check whether the callframe
was created by a reentrant native call to JavaScript after tearing off
the local variables instead of before.

JavaScriptCore:

• VM/Machine.cpp: (KJS::Machine::unwindCallFrame):

LayoutTests:

• fast/js/reentrant-call-unwind-expected.txt: Added.
• fast/js/reentrant-call-unwind.html: Added.
• fast/js/resources/reentrant-call-unwind.js: Added.

File:

• trunk/JavaScriptCore/VM/Machine.cpp (modified) (2 diffs)

trunk/JavaScriptCore/VM/Machine.cpp

@@ -576 +576 @@
     if (isGlobalCallFrame(registerBase, r))
         return false;
-
-    codeBlock = callFrame[CallerCodeBlock].u.codeBlock;
-    if (!codeBlock)
-        return false;
-
+    
     // If this call frame created an activation, tear it off.
     if (JSActivation* activation = static_cast<JSActivation*>(callFrame[OptionalCalleeActivation].u.jsValue)) {
@@ -586 +582 @@
         activation->copyRegisters();
     }
+    
+    codeBlock = callFrame[CallerCodeBlock].u.codeBlock;
+    if (!codeBlock)
+        return false;
 
     k = codeBlock->jsValues.data();