Changeset 58779 in webkit for trunk/JavaScriptCore/debugger

Timestamp:

May 4, 2010, 3:01:38 PM (15 years ago)

Author:

[email protected]

Message:

2010-05-04 Yongjun Zhang <​[email protected]>

Reviewed by Darin Adler.

WebKit crashes at DebuggerCallFrame::functionName() if m_callFrame is the top global callframe.
​https://bugs.webkit.org/show_bug.cgi?id=38535

Don't call asFunction if callee is not a FunctionType to prevent assertion failure
in JSCell::isObject().

• debugger/DebuggerCallFrame.cpp: (JSC::DebuggerCallFrame::functionName): (JSC::DebuggerCallFrame::calculatedFunctionName):

File:

• trunk/JavaScriptCore/debugger/DebuggerCallFrame.cpp (modified) (2 diffs)

trunk/JavaScriptCore/debugger/DebuggerCallFrame.cpp

@@ -42 +42 @@
         return 0;
 
+    if (!m_callFrame->callee())
+        return 0;
+
     JSFunction* function = asFunction(m_callFrame->callee());
     if (!function)
@@ -52 +55 @@
     if (!m_callFrame->codeBlock())
         return UString();
-    
+
+    if (!m_callFrame->callee())
+        return UString();
+
     JSFunction* function = asFunction(m_callFrame->callee());
     if (!function)