Changeset 42605 in webkit for trunk/JavaScriptCore/runtime/JSArray.cpp

Timestamp:

Apr 16, 2009, 9:41:29 PM (16 years ago)

Author:

[email protected]

Message:

Fix subtle error in optimised VM reentry in Array.sort

Reviewed by Gavin Barraclough

Basically to ensure we don't accidentally invalidate the cached callframe
we should be using the cached callframe rather than our own exec state.
While the old behaviour was wrong i have been unable to actually create a
test case where anything actually ends up going wrong.

File:

• trunk/JavaScriptCore/runtime/JSArray.cpp (modified) (1 diff)

trunk/JavaScriptCore/runtime/JSArray.cpp

@@ -789 +789 @@
             m_cachedCall->setArgument(0, va);
             m_cachedCall->setArgument(1, vb);
-            compareResult = m_cachedCall->call().toNumber(m_exec);
+            compareResult = m_cachedCall->call().toNumber(m_cachedCall->newCallFrame());
         } else {
             ArgList arguments;