Changeset 40108 in webkit for trunk/JavaScriptCore/interpreter/Interpreter.cpp

Timestamp:

Jan 21, 2009, 7:35:42 PM (16 years ago)

Author:

[email protected]

Message:

2009-01-21 Gavin Barraclough <​[email protected]>

Reviewed by Geoff Garen.

Fix for ​https://bugs.webkit.org/show_bug.cgi?id=23468.

• interpreter/Interpreter.cpp: (JSC::Interpreter::privateExecute):

File:

• trunk/JavaScriptCore/interpreter/Interpreter.cpp (modified) (2 diffs)

trunk/JavaScriptCore/interpreter/Interpreter.cpp

@@ -2552 +2552 @@
                 RefPtr<Structure>* end = it + count;
 
-                JSObject* baseObject = asObject(baseCell);
-                while (1) {
-                    baseObject = asObject(baseObject->structure()->prototypeForLookup(callFrame));
+                while (true) {
+                    JSObject* baseObject = asObject(baseCell->structure()->prototypeForLookup(callFrame));
+
                     if (UNLIKELY(baseObject->structure() != (*it).get()))
                         break;
@@ -2568 +2568 @@
                         NEXT_INSTRUCTION();
                     }
+
+                    // Update baseCell, so that next time around the loop we'll pick up the prototype's prototype.
+                    baseCell = baseObject;
                 }
             }