Changeset 62766 in webkit for trunk/JavaScriptCore/interpreter

Timestamp:

Jul 8, 2010, 12:50:54 AM (15 years ago)

Author:

[email protected]

Message:

2010-07-08 Andreas Kling <​[email protected]>

Reviewed by Oliver Hunt.

Interpreter: Crash in op_load_varargs on 64-bit
​https://bugs.webkit.org/show_bug.cgi?id=41795

Added missing cast of argCount to int32_t in op_load_varargs.

• interpreter/Interpreter.cpp: (JSC::Interpreter::privateExecute):

File:

• trunk/JavaScriptCore/interpreter/Interpreter.cpp (modified) (1 diff)

trunk/JavaScriptCore/interpreter/Interpreter.cpp

@@ -3777 +3777 @@
             // Then we copy any additional arguments that may be further up the stack ('-1' to account for 'this')
             for (; i < static_cast<int32_t>(argCount); i++)
-                argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams - argCount - 1];
+                argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams - static_cast<int32_t>(argCount) - 1];
         } else if (!arguments.isUndefinedOrNull()) {
             if (!arguments.isObject()) {