Changeset 51672 in webkit for trunk/JavaScriptCore/runtime

Timestamp:

Dec 3, 2009, 6:17:46 PM (15 years ago)

Author:

[email protected]

Message:

REGRESSION(4.0.3-48777): Crash in JSC::ExecState::propertyNames() (Debug-only?)
​https://bugs.webkit.org/show_bug.cgi?id=32133

Reviewed by Gavin Barraclough.

Work around odd GCC-ism and correct the scopechain for use by
calls made while a cachedcall is active on the callstack.

Location:

trunk/JavaScriptCore/runtime

Files:

• ArrayPrototype.cpp (modified) (2 diffs)
• JSArray.cpp (modified) (1 diff)
• StringPrototype.cpp (modified) (1 diff)

trunk/JavaScriptCore/runtime/ArrayPrototype.cpp

@@ -746 +746 @@
             cachedCall.setArgument(1, jsNumber(exec, k));
             cachedCall.setArgument(2, thisObj);
-            
-            if (!cachedCall.call().toBoolean(exec))
+            JSValue result = cachedCall.call();
+            if (!result.toBoolean(cachedCall.newCallFrame(exec)))
                 return jsBoolean(false);
         }
@@ -847 +847 @@
             cachedCall.setArgument(1, jsNumber(exec, k));
             cachedCall.setArgument(2, thisObj);
-            
-            if (cachedCall.call().toBoolean(exec))
+            JSValue result = cachedCall.call();
+            if (result.toBoolean(cachedCall.newCallFrame(exec)))
                 return jsBoolean(true);
         }

trunk/JavaScriptCore/runtime/JSArray.cpp

@@ -786 +786 @@
             m_cachedCall->setArgument(0, va);
             m_cachedCall->setArgument(1, vb);
-            compareResult = m_cachedCall->call().toNumber(m_cachedCall->newCallFrame());
+            compareResult = m_cachedCall->call().toNumber(m_cachedCall->newCallFrame(m_exec));
         } else {
             MarkedArgumentBuffer arguments;

trunk/JavaScriptCore/runtime/StringPrototype.cpp

@@ -282 +282 @@
                 
                 cachedCall.setThis(exec->globalThisValue());
-                replacements.append(cachedCall.call().toString(cachedCall.newCallFrame()));
+                JSValue result = cachedCall.call();
+                replacements.append(result.toString(cachedCall.newCallFrame(exec)));
                 if (exec->hadException())
                     break;