Changeset 41806 in webkit for trunk/JavaScriptCore/parser/Nodes.cpp

Timestamp:

Mar 18, 2009, 12:24:39 AM (16 years ago)

Author:

[email protected]

Message:

<rdar://problem/6692138> REGRESSION (Safari 4): Incorrect function return value when using IE "try ... finally" memory leak work-around (24654)
<​https://bugs.webkit.org/show_bug.cgi?id=24654>

Reviewed by Cameron Zwarich.

If the return value for a function is in a local register we need
to copy it before executing any finalisers, otherwise it is possible
for the finaliser to clobber the result.

File:

• trunk/JavaScriptCore/parser/Nodes.cpp (modified) (1 diff)

trunk/JavaScriptCore/parser/Nodes.cpp

@@ -2010 +2010 @@
         dst = 0;
     RegisterID* r0 = m_value ? generator.emitNode(dst, m_value.get()) : generator.emitLoad(dst, jsUndefined());
+    RefPtr<RegisterID> returnRegister;
     if (generator.scopeDepth()) {
         RefPtr<Label> l0 = generator.newLabel();
+        if (generator.hasFinaliser() && !r0->isTemporary()) {
+            returnRegister = generator.emitMove(generator.newTemporary(), r0);
+            r0 = returnRegister.get();
+        }
         generator.emitJumpScopes(l0.get(), 0);
         generator.emitLabel(l0.get());