Changeset 36853 in webkit for trunk/JavaScriptCore/VM/CodeGenerator.h

Timestamp:

Sep 24, 2008, 10:54:10 AM (17 years ago)

Author:

[email protected]

Message:

2008-09-24 Geoffrey Garen <​[email protected]>

Reviewed by Cameron Zwarich.

Fixed ​https://bugs.webkit.org/show_bug.cgi?id=21057
Crash in RegisterID::deref() running fast/canvas/canvas-putImageData.html

• VM/CodeGenerator.h: Changed declaration order to ensure the m_lastConstant, which is a RefPtr that points into m_calleeRegisters, has its destructor called before the destructor for m_calleeRegisters.

File:

• trunk/JavaScriptCore/VM/CodeGenerator.h (modified) (1 diff)

trunk/JavaScriptCore/VM/CodeGenerator.h

@@ -417 +417 @@
         HashSet<RefPtr<UString::Rep>, IdentifierRepHash> m_functions;
         RegisterID m_thisRegister;
-        RefPtr<RegisterID> m_lastConstant;
         SegmentedVector<RegisterID, 512> m_calleeRegisters;
         SegmentedVector<RegisterID, 512> m_parameters;
         SegmentedVector<RegisterID, 512> m_globals;
         SegmentedVector<LabelID, 512> m_labels;
+        RefPtr<RegisterID> m_lastConstant;
         int m_finallyDepth;
         int m_dynamicScopeDepth;