Changeset 51672 in webkit for trunk/JavaScriptCore/interpreter/CallFrame.h

Timestamp:

Dec 3, 2009, 6:17:46 PM (15 years ago)

Author:

[email protected]

Message:

REGRESSION(4.0.3-48777): Crash in JSC::ExecState::propertyNames() (Debug-only?)
​https://bugs.webkit.org/show_bug.cgi?id=32133

Reviewed by Gavin Barraclough.

Work around odd GCC-ism and correct the scopechain for use by
calls made while a cachedcall is active on the callstack.

File:

• trunk/JavaScriptCore/interpreter/CallFrame.h (modified) (2 diffs)

trunk/JavaScriptCore/interpreter/CallFrame.h

@@ -40 +40 @@
         JSFunction* callee() const { return this[RegisterFile::Callee].function(); }
         CodeBlock* codeBlock() const { return this[RegisterFile::CodeBlock].Register::codeBlock(); }
-        ScopeChainNode* scopeChain() const { return this[RegisterFile::ScopeChain].Register::scopeChain(); }
+        ScopeChainNode* scopeChain() const
+        {
+            ASSERT(this[RegisterFile::ScopeChain].Register::scopeChain());
+            return this[RegisterFile::ScopeChain].Register::scopeChain();
+        }
         int argumentCount() const { return this[RegisterFile::ArgumentCount].i(); }
 
@@ -67 +71 @@
         JSGlobalData& globalData() const
         {
+            ASSERT(scopeChain()->globalData);
             return *scopeChain()->globalData;
         }