Changeset 173031 in webkit

Timestamp:

Aug 27, 2014 4:06:00 PM (10 years ago)

Author:

commit-queue@webkit.org

Message:

Ensure that the call frame passed from JIT code via JSC::operationCallEval to JSC::eval always contains the valid scope chain.
​https://bugs.webkit.org/show_bug.cgi?id=136313

Patch by Akos Kiss <​akiss@inf.u-szeged.hu> on 2014-08-27
Reviewed by Michael Saboff.

Do not rely on calling conventions to fill in the CallerFrame component
of the execCallee parameter of JSC::operationCallEval.

• jit/JITOperations.cpp:

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• jit/JITOperations.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-08-27  Akos Kiss  <akiss@inf.u-szeged.hu>
+
+        Ensure that the call frame passed from JIT code via JSC::operationCallEval to JSC::eval always contains the valid scope chain.
+        https://bugs.webkit.org/show_bug.cgi?id=136313
+
+        Reviewed by Michael Saboff.
+
+        Do not rely on calling conventions to fill in the CallerFrame component
+        of the execCallee parameter of JSC::operationCallEval.
+
+        * jit/JITOperations.cpp:
+
 2014-08-27  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/jit/JITOperations.cpp

@@ -612 +612 @@
     execCallee->setScope(exec->scope());
     execCallee->setCodeBlock(0);
+    execCallee->setCallerFrame(exec);
 
     if (!isHostFunction(execCallee->calleeAsValue(), globalFuncEval))