Changeset 36853 in webkit for trunk/JavaScriptCore

Timestamp:

Sep 24, 2008, 10:54:10 AM (17 years ago)

Author:

[email protected]

Message:

2008-09-24 Geoffrey Garen <​[email protected]>

Reviewed by Cameron Zwarich.

Fixed ​https://bugs.webkit.org/show_bug.cgi?id=21057
Crash in RegisterID::deref() running fast/canvas/canvas-putImageData.html

• VM/CodeGenerator.h: Changed declaration order to ensure the m_lastConstant, which is a RefPtr that points into m_calleeRegisters, has its destructor called before the destructor for m_calleeRegisters.

Location:

trunk/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• VM/CodeGenerator.h (modified) (1 diff)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2008-09-24  Geoffrey Garen  <[email protected]>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21057
+        Crash in RegisterID::deref() running fast/canvas/canvas-putImageData.html
+
+        * VM/CodeGenerator.h: Changed declaration order to ensure the
+        m_lastConstant, which is a RefPtr that points into m_calleeRegisters,
+        has its destructor called before the destructor for m_calleeRegisters.
+
 2008-09-24  Darin Adler  <[email protected]>
 

trunk/JavaScriptCore/VM/CodeGenerator.h

@@ -417 +417 @@
         HashSet<RefPtr<UString::Rep>, IdentifierRepHash> m_functions;
         RegisterID m_thisRegister;
-        RefPtr<RegisterID> m_lastConstant;
         SegmentedVector<RegisterID, 512> m_calleeRegisters;
         SegmentedVector<RegisterID, 512> m_parameters;
         SegmentedVector<RegisterID, 512> m_globals;
         SegmentedVector<LabelID, 512> m_labels;
+        RefPtr<RegisterID> m_lastConstant;
         int m_finallyDepth;
         int m_dynamicScopeDepth;