Changeset 78727 in webkit for trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

Timestamp:

Feb 16, 2011, 11:31:16 AM (14 years ago)

Author:

[email protected]

Message:

2011-02-16 Oliver Hunt <​[email protected]>

Reviewed by Geoff Garen.

Incorrect handling of global writes in dynamic contexts
​https://bugs.webkit.org/show_bug.cgi?id=49383

Add a few tests to ensure that global writes are actually
allowed inside dynamic scopes.

• fast/js/basic-strict-mode-expected.txt:
• fast/js/script-tests/basic-strict-mode.js:

2011-02-16 Oliver Hunt <​[email protected]>

Reviewed by Geoff Garen.

Incorrect handling of global writes in dynamic contexts
​https://bugs.webkit.org/show_bug.cgi?id=49383

• interpreter/Interpreter.cpp: (JSC::Interpreter::privateExecute): Can't use the existing callframe to return an uncaught exception as by definition that callframe has already been torn down.
• parser/ASTBuilder.h: (JSC::ASTBuilder::ASTBuilder): (JSC::ASTBuilder::varDeclarations): (JSC::ASTBuilder::funcDeclarations): (JSC::ASTBuilder::features): (JSC::ASTBuilder::numConstants): (JSC::ASTBuilder::createFuncDeclStatement): (JSC::ASTBuilder::addVar): (JSC::ASTBuilder::incConstants): (JSC::ASTBuilder::usesThis): (JSC::ASTBuilder::usesCatch): (JSC::ASTBuilder::usesClosures): (JSC::ASTBuilder::usesArguments): (JSC::ASTBuilder::usesAssignment): (JSC::ASTBuilder::usesWith): (JSC::ASTBuilder::usesEval): Don't need a vector of scopes in the ASTBuilder
• runtime/Operations.h: (JSC::resolveBase): In strict mode the optimisation that we use to skip a lookup on the global object is incorrect and lead to us always disallowing global writes when we needed to do a dynamic slot lookup. Now the strict mode path actually checks for the property.

File:

• trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

@@ -2450 +2450 @@
     }
     DEFINE_OPCODE(op_resolve_base) {
-        /* resolve_base dst(r) property(id)
+        /* resolve_base dst(r) property(id) isStrict(bool)
 
            Searches the scope chain for an object containing
            identifier property, and if one is found, writes it to
-           register dst. If none is found, the outermost scope (which
-           will be the global object) is stored in register dst.
+           register dst. If none is found and isStrict is false, the
+           outermost scope (which will be the global object) is
+           stored in register dst.
         */
         resolveBase(callFrame, vPC);
+        CHECK_FOR_EXCEPTION();
 
         vPC += OPCODE_LENGTH(op_resolve_base);
@@ -4777 +4779 @@
             exceptionValue = createInterruptedExecutionException(globalData);
         }
+        JSGlobalObject* globalObject = callFrame->lexicalGlobalObject();
         handler = throwException(callFrame, exceptionValue, vPC - codeBlock->instructions().begin());
-        if (!handler)
-            return throwError(callFrame, exceptionValue);
+        if (!handler) {
+            // Can't use the callframe at this point as the scopechain, etc have
+            // been released.
+            return throwError(globalObject->globalExec(), exceptionValue);
+        }
 
         codeBlock = callFrame->codeBlock();