Changeset 167729 in webkit

Timestamp:

Apr 23, 2014 3:35:16 PM (10 years ago)

Author:

mhahnenberg@apple.com

Message:

Arguments::copyBackingStore needs to update m_registers in tandem with m_registerArray
​https://bugs.webkit.org/show_bug.cgi?id=132079

Reviewed by Michael Saboff.

Since we're moving the register backing store, we don't want to leave a dangling pointer into a random CopiedBlock.

Also added a test that previously triggered this bug.

• runtime/Arguments.cpp:

(JSC::Arguments::copyBackingStore): D'oh!

• tests/stress/arguments-copy-register-array-backing-store.js: Added.

(foo):
(bar):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/Arguments.cpp (modified) (1 diff)
• tests/stress/arguments-copy-register-array-backing-store.js (added)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-04-23  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Arguments::copyBackingStore needs to update m_registers in tandem with m_registerArray
+        https://bugs.webkit.org/show_bug.cgi?id=132079
+
+        Reviewed by Michael Saboff.
+
+        Since we're moving the register backing store, we don't want to leave a dangling pointer into a random CopiedBlock.
+
+        Also added a test that previously triggered this bug.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::copyBackingStore): D'oh!
+        * tests/stress/arguments-copy-register-array-backing-store.js: Added.
+        (foo):
+        (bar):
+
 2014-04-23  Mark Rowe  <mrowe@apple.com>
 

trunk/Source/JavaScriptCore/runtime/Arguments.cpp

@@ -79 +79 @@
             memcpy(newRegisterArray, registerArray, bytes);
             thisObject->m_registerArray.setWithoutWriteBarrier(newRegisterArray);
+            thisObject->m_registers = newRegisterArray - CallFrame::offsetFor(1) - 1;
             visitor.didCopy(registerArray, bytes);
         }