Changeset 61588 in webkit


Ignore:
Timestamp:
Jun 21, 2010 4:17:48 PM (14 years ago)
Author:
oliver@apple.com
Message:

2010-06-21 Oliver Hunt <​oliver@apple.com>

Reviewed by Geoffrey Garen.

Make JSC more resilient in the face of parse failures
​https://bugs.webkit.org/show_bug.cgi?id=40951

A number of recent bugs have occurred due to issues like miscounting
BOMs, etc which lead to interesting crashes later on. Adding this
logic hardens JSC in the face of these errors, and has no impact on
performance (32bit jit actually gets 0.7% faster but I put that down
to cache effects).

  • bytecode/CodeBlock.cpp: (JSC::CodeBlock::reparseForExceptionInfoIfNecessary): (JSC::CodeBlock::lineNumberForBytecodeOffset): (JSC::CodeBlock::expressionRangeForBytecodeOffset): (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
  • bytecode/CodeBlock.h: (JSC::CodeBlock::bytecodeOffset):
  • interpreter/Interpreter.cpp: (JSC::Interpreter::execute): (JSC::Interpreter::executeCall): (JSC::Interpreter::executeConstruct): (JSC::Interpreter::prepareForRepeatCall): (JSC::Interpreter::privateExecute):
  • jit/JITOpcodes.cpp: (JSC::JIT::privateCompileCTIMachineTrampolines):
  • jit/JITOpcodes32_64.cpp: (JSC::JIT::privateCompileCTIMachineTrampolines):
  • jit/JITStubs.cpp: (JSC::DEFINE_STUB_FUNCTION):
  • runtime/ArrayPrototype.cpp: (JSC::isNumericCompareFunction):
  • runtime/Executable.cpp: (JSC::FunctionExecutable::compileForCall): (JSC::FunctionExecutable::compileForConstruct): (JSC::FunctionExecutable::generateJITCodeForCall): (JSC::FunctionExecutable::generateJITCodeForConstruct): (JSC::FunctionExecutable::reparseExceptionInfo): (JSC::EvalExecutable::reparseExceptionInfo):
  • runtime/Executable.h: (JSC::FunctionExecutable::bytecodeForCall): (JSC::FunctionExecutable::bytecodeForConstruct):
  • runtime/JSGlobalData.cpp: (JSC::JSGlobalData::numericCompareFunction):
Location:
trunk/JavaScriptCore
Files:
11 edited

Legend:

Unmodified
Added
Removed

  • trunk/JavaScriptCore/ChangeLog

    r61577 r61588  
     12010-06-21  Oliver Hunt  <oliver@apple.com>
     2
     3        Reviewed by Geoffrey Garen.
     4
     5        Make JSC more resilient in the face of parse failures
     6        https://bugs.webkit.org/show_bug.cgi?id=40951
     7
     8        A number of recent bugs have occurred due to issues like miscounting
     9        BOMs, etc which lead to interesting crashes later on.  Adding this
     10        logic hardens JSC in the face of these errors, and has no impact on
     11        performance (32bit jit actually gets 0.7% faster but I put that down
     12        to cache effects).
     13
     14        * bytecode/CodeBlock.cpp:
     15        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
     16        (JSC::CodeBlock::lineNumberForBytecodeOffset):
     17        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
     18        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
     19        * bytecode/CodeBlock.h:
     20        (JSC::CodeBlock::bytecodeOffset):
     21        * interpreter/Interpreter.cpp:
     22        (JSC::Interpreter::execute):
     23        (JSC::Interpreter::executeCall):
     24        (JSC::Interpreter::executeConstruct):
     25        (JSC::Interpreter::prepareForRepeatCall):
     26        (JSC::Interpreter::privateExecute):
     27        * jit/JITOpcodes.cpp:
     28        (JSC::JIT::privateCompileCTIMachineTrampolines):
     29        * jit/JITOpcodes32_64.cpp:
     30        (JSC::JIT::privateCompileCTIMachineTrampolines):
     31        * jit/JITStubs.cpp:
     32        (JSC::DEFINE_STUB_FUNCTION):
     33        * runtime/ArrayPrototype.cpp:
     34        (JSC::isNumericCompareFunction):
     35        * runtime/Executable.cpp:
     36        (JSC::FunctionExecutable::compileForCall):
     37        (JSC::FunctionExecutable::compileForConstruct):
     38        (JSC::FunctionExecutable::generateJITCodeForCall):
     39        (JSC::FunctionExecutable::generateJITCodeForConstruct):
     40        (JSC::FunctionExecutable::reparseExceptionInfo):
     41        (JSC::EvalExecutable::reparseExceptionInfo):
     42        * runtime/Executable.h:
     43        (JSC::FunctionExecutable::bytecodeForCall):
     44        (JSC::FunctionExecutable::bytecodeForConstruct):
     45        * runtime/JSGlobalData.cpp:
     46        (JSC::JSGlobalData::numericCompareFunction):
     47
    1482010-06-21  John Sullivan  <sullivan@apple.com>
    249

  • trunk/JavaScriptCore/bytecode/CodeBlock.cpp

    r61430 r61588  
    15201520}
    15211521
    1522 void CodeBlock::reparseForExceptionInfoIfNecessary(CallFrame* callFrame)
     1522bool CodeBlock::reparseForExceptionInfoIfNecessary(CallFrame* callFrame)
    15231523{
    15241524    if (m_exceptionInfo)
    1525         return;
     1525        return true;
    15261526
    15271527    ASSERT(!m_rareData || !m_rareData->m_exceptionHandlers.size());
    … …  
    15401540
    15411541    m_exceptionInfo.set(m_ownerExecutable->reparseExceptionInfo(m_globalData, scopeChain, this));
     1542    return m_exceptionInfo;
    15421543}
    15431544
    … …  
    15641565    ASSERT(bytecodeOffset < m_instructionCount);
    15651566
    1566     reparseForExceptionInfoIfNecessary(callFrame);
    1567     ASSERT(m_exceptionInfo);
    1568 
    1569     if (!m_exceptionInfo->m_lineInfo.size())
    1570         return m_ownerExecutable->source().firstLine(); // Empty function
     1567    if (!reparseForExceptionInfoIfNecessary(callFrame) || !m_exceptionInfo->m_lineInfo.size())
     1568        return m_ownerExecutable->source().firstLine(); // Empty function or unable to reparse
    15711569
    15721570    int low = 0;
    … …  
    15891587    ASSERT(bytecodeOffset < m_instructionCount);
    15901588
    1591     reparseForExceptionInfoIfNecessary(callFrame);
    1592     ASSERT(m_exceptionInfo);
    1593 
    1594     if (!m_exceptionInfo->m_expressionInfo.size()) {
     1589    if (!reparseForExceptionInfoIfNecessary(callFrame) || !m_exceptionInfo->m_expressionInfo.size()) {
    15951590        // We didn't think anything could throw.  Apparently we were wrong.
     1591        // Alternatively something went wrong when trying to reparse
    15961592        startOffset = 0;
    15971593        endOffset = 0;
    … …  
    16281624    ASSERT(bytecodeOffset < m_instructionCount);
    16291625
    1630     reparseForExceptionInfoIfNecessary(callFrame);
    1631     ASSERT(m_exceptionInfo);       
    1632 
    1633     if (!m_exceptionInfo->m_getByIdExceptionInfo.size())
     1626    if (!reparseForExceptionInfoIfNecessary(callFrame) || !m_exceptionInfo->m_getByIdExceptionInfo.size())
    16341627        return false;
    16351628

  • trunk/JavaScriptCore/bytecode/CodeBlock.h

    r61324 r61588  
    352352        unsigned bytecodeOffset(CallFrame* callFrame, ReturnAddressPtr returnAddress)
    353353        {
    354             reparseForExceptionInfoIfNecessary(callFrame);
     354            if (!reparseForExceptionInfoIfNecessary(callFrame))
     355                return 0;
    355356            return binaryChop<CallReturnOffsetToBytecodeOffset, unsigned, getCallReturnOffset>(callReturnIndexVector().begin(), callReturnIndexVector().size(), getJITCode().offsetOf(returnAddress.value()))->bytecodeOffset;
    356357        }
    … …  
    522523#endif
    523524
    524         void reparseForExceptionInfoIfNecessary(CallFrame*);
     525        bool reparseForExceptionInfoIfNecessary(CallFrame*) WARN_UNUSED_RETURN;
    525526
    526527        void createRareDataIfNecessary()

  • trunk/JavaScriptCore/interpreter/Interpreter.cpp

    r61553 r61588  
    644644
    645645    CodeBlock* codeBlock = &program->bytecode(callFrame, scopeChain);
     646    if (!codeBlock) {
     647        *exception = createStackOverflowError(callFrame);
     648        return jsNull();
     649    }
    646650
    647651    Register* oldEnd = m_registerFile.end();
    … …  
    723727    if (callType == CallTypeJS) {
    724728        ScopeChainNode* callDataScopeChain = callData.js.scopeChain;
    725         CodeBlock* newCodeBlock = &callData.js.functionExecutable->bytecodeForCall(callFrame, callDataScopeChain);
    726 
    727         newCallFrame = slideRegisterWindowForCall(newCodeBlock, &m_registerFile, newCallFrame, registerOffset, argCount);
     729        CodeBlock* newCodeBlock = callData.js.functionExecutable->bytecodeForCall(callFrame, callDataScopeChain);
     730
     731        if (newCodeBlock)
     732            newCallFrame = slideRegisterWindowForCall(newCodeBlock, &m_registerFile, newCallFrame, registerOffset, argCount);
     733        else
     734            newCallFrame = 0;
    728735        if (UNLIKELY(!newCallFrame)) {
    729736            *exception = createStackOverflowError(callFrame);
    … …  
    812819    if (constructType == ConstructTypeJS) {
    813820        ScopeChainNode* constructDataScopeChain = constructData.js.scopeChain;
    814         CodeBlock* newCodeBlock = &constructData.js.functionExecutable->bytecodeForConstruct(callFrame, constructDataScopeChain);
    815 
    816         newCallFrame = slideRegisterWindowForCall(newCodeBlock, &m_registerFile, newCallFrame, registerOffset, argCount);
     821        CodeBlock* newCodeBlock = constructData.js.functionExecutable->bytecodeForConstruct(callFrame, constructDataScopeChain);
     822        if (newCodeBlock)
     823            newCallFrame = slideRegisterWindowForCall(newCodeBlock, &m_registerFile, newCallFrame, registerOffset, argCount);
     824        else
     825            newCallFrame = 0;
     826
    817827        if (UNLIKELY(!newCallFrame)) {
    818828            *exception = createStackOverflowError(callFrame);
    … …  
    903913        newCallFrame->r(++dst) = jsUndefined();
    904914   
    905     CodeBlock* codeBlock = &FunctionExecutable->bytecodeForCall(callFrame, scopeChain);
    906     newCallFrame = slideRegisterWindowForCall(codeBlock, &m_registerFile, newCallFrame, argc + RegisterFile::CallFrameHeaderSize, argc);
     915    CodeBlock* codeBlock = FunctionExecutable->bytecodeForCall(callFrame, scopeChain);
     916    if (codeBlock)
     917        newCallFrame = slideRegisterWindowForCall(codeBlock, &m_registerFile, newCallFrame, argc + RegisterFile::CallFrameHeaderSize, argc);
     918    else
     919        newCallFrame = 0;
    907920    if (UNLIKELY(!newCallFrame)) {
    908921        *exception = createStackOverflowError(callFrame);
    … …  
    969982
    970983    EvalCodeBlock* codeBlock = &eval->bytecode(callFrame, scopeChain);
     984    if (!codeBlock) {
     985        *exception = createStackOverflowError(callFrame);
     986        return jsNull();
     987    }
    971988
    972989    JSVariableObject* variableObject;
    … …  
    36203637        if (callType == CallTypeJS) {
    36213638            ScopeChainNode* callDataScopeChain = callData.js.scopeChain;
    3622             CodeBlock* newCodeBlock = &callData.js.functionExecutable->bytecodeForCall(callFrame, callDataScopeChain);
     3639            CodeBlock* newCodeBlock = callData.js.functionExecutable->bytecodeForCall(callFrame, callDataScopeChain);
    36233640
    36243641            CallFrame* previousCallFrame = callFrame;
    3625 
    3626             callFrame = slideRegisterWindowForCall(newCodeBlock, registerFile, callFrame, registerOffset, argCount);
     3642            if (newCodeBlock)
     3643                callFrame = slideRegisterWindowForCall(newCodeBlock, registerFile, callFrame, registerOffset, argCount);
     3644            else
     3645                callFrame = 0;
    36273646            if (UNLIKELY(!callFrame)) {
    36283647                callFrame = previousCallFrame;
    … …  
    37723791        if (callType == CallTypeJS) {
    37733792            ScopeChainNode* callDataScopeChain = callData.js.scopeChain;
    3774             CodeBlock* newCodeBlock = &callData.js.functionExecutable->bytecodeForCall(callFrame, callDataScopeChain);
     3793            CodeBlock* newCodeBlock = callData.js.functionExecutable->bytecodeForCall(callFrame, callDataScopeChain);
    37753794           
    37763795            CallFrame* previousCallFrame = callFrame;
    3777            
    3778             callFrame = slideRegisterWindowForCall(newCodeBlock, registerFile, callFrame, registerOffset, argCount);
     3796            if (newCodeBlock)
     3797                callFrame = slideRegisterWindowForCall(newCodeBlock, registerFile, callFrame, registerOffset, argCount);
     3798            else
     3799                callFrame = 0;
    37793800            if (UNLIKELY(!callFrame)) {
    37803801                callFrame = previousCallFrame;
    … …  
    40954116        if (constructType == ConstructTypeJS) {
    40964117            ScopeChainNode* callDataScopeChain = constructData.js.scopeChain;
    4097             CodeBlock* newCodeBlock = &constructData.js.functionExecutable->bytecodeForConstruct(callFrame, callDataScopeChain);
     4118            CodeBlock* newCodeBlock = constructData.js.functionExecutable->bytecodeForConstruct(callFrame, callDataScopeChain);
    40984119
    40994120            CallFrame* previousCallFrame = callFrame;
    41004121
    4101             callFrame = slideRegisterWindowForCall(newCodeBlock, registerFile, callFrame, registerOffset, argCount);
     4122            if (newCodeBlock)
     4123                callFrame = slideRegisterWindowForCall(newCodeBlock, registerFile, callFrame, registerOffset, argCount);
     4124            else
     4125                callFrame = 0;
     4126
    41024127            if (UNLIKELY(!callFrame)) {
    41034128                callFrame = previousCallFrame;

  • trunk/JavaScriptCore/jit/JITOpcodes.cpp

    r60901 r61588  
    7474    // VirtualCallLink Trampoline
    7575    // regT0 holds callee, regT1 holds argCount.  regT2 will hold the FunctionExecutable.
     76    JumpList callLazyLinkFailures;
    7677    Label virtualCallLinkBegin = align();
    7778    compileOpCallInitializeCallFrame();
    … …  
    8081    restoreArgumentReference();
    8182    Call callLazyLinkCall = call();
     83    callLazyLinkFailures.append(branchTestPtr(Zero, regT0));
    8284    restoreReturnAddressBeforeReturn(regT3);
    8385    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT1);
    … …  
    9294    restoreArgumentReference();
    9395    Call callLazyLinkConstruct = call();
     96    callLazyLinkFailures.append(branchTestPtr(Zero, regT0));
    9497    restoreReturnAddressBeforeReturn(regT3);
    9598    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT1);
    9699    jump(regT0);
     100
     101    // If the parser fails we want to be able to be able to keep going,
     102    // So we handle this as a parse failure.
     103    callLazyLinkFailures.link(this);
     104    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
     105    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
     106    restoreReturnAddressBeforeReturn(regT1);
     107    move(ImmPtr(&globalData->exceptionLocation), regT2);
     108    storePtr(regT1, regT2);
     109    poke(callFrameRegister, 1 + OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
     110    poke(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()));
     111    ret();
     112   
    97113
    98114    // VirtualCall Trampoline

  • trunk/JavaScriptCore/jit/JITOpcodes32_64.cpp

    r60901 r61588  
    6767
    6868    // (2) Trampolines for the slow cases of op_call / op_call_eval / op_construct.
    69 
    7069#if ENABLE(JIT_OPTIMIZE_CALL)
     70    JumpList callLazyLinkFailures;
    7171    // VirtualCallLink Trampoline
    7272    // regT0 holds callee, regT1 holds argCount.  regT2 will hold the FunctionExecutable.
    … …  
    7777    restoreArgumentReference();
    7878    Call callLazyLinkCall = call();
     79    callLazyLinkFailures.append(branchTestPtr(Zero, regT0));
    7980    restoreReturnAddressBeforeReturn(regT3);
    8081    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT1);
    … …  
    9091    Call callLazyLinkConstruct = call();
    9192    restoreReturnAddressBeforeReturn(regT3);
     93    callLazyLinkFailures.append(branchTestPtr(Zero, regT0));
    9294    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT1);
    9395    jump(regT0);
     96
     97    // If the parser fails we want to be able to be able to keep going,
     98    // So we handle this as a parse failure.
     99    callLazyLinkFailures.link(this);
     100    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
     101    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
     102    restoreReturnAddressBeforeReturn(regT1);
     103    move(ImmPtr(&globalData->exceptionLocation), regT2);
     104    storePtr(regT1, regT2);
     105    poke(callFrameRegister, 1 + OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof(void*));
     106    poke(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()));
     107    ret();
     108
    94109#endif // ENABLE(JIT_OPTIMIZE_CALL)
    95110

  • trunk/JavaScriptCore/jit/JITStubs.cpp

    r61553 r61588  
    19681968    else {
    19691969        FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
    1970         codeBlock = &functionExecutable->bytecodeForCall(stackFrame.callFrame, callee->scope().node());
     1970        codeBlock = functionExecutable->bytecodeForCall(stackFrame.callFrame, callee->scope().node());
     1971        if (!codeBlock) {
     1972            stackFrame.callFrame->globalData().exception = createStackOverflowError(callFrame);
     1973            return 0;
     1974        }
    19711975        functionExecutable->jitCodeForCall(callFrame, callee->scope().node());
    19721976        if (callFrame->argumentCountIncludingThis() == static_cast<size_t>(codeBlock->m_numParameters))
    … …  
    19982002    else {
    19992003        FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
    2000         codeBlock = &functionExecutable->bytecodeForConstruct(stackFrame.callFrame, callee->scope().node());
     2004        codeBlock = functionExecutable->bytecodeForConstruct(stackFrame.callFrame, callee->scope().node());
     2005        if (!codeBlock) {
     2006            throwStackOverflowError(callFrame, stackFrame.globalData, ReturnAddressPtr(callFrame->returnPC()), STUB_RETURN_ADDRESS);
     2007            VM_THROW_EXCEPTION();
     2008        }
    20012009        functionExecutable->jitCodeForConstruct(callFrame, callee->scope().node());
    20022010        if (callFrame->argumentCountIncludingThis() == static_cast<size_t>(codeBlock->m_numParameters))

  • trunk/JavaScriptCore/runtime/ArrayPrototype.cpp

    r60762 r61588  
    7878    // function with a CodeBlock also has JIT code.
    7979    callData.js.functionExecutable->jitCodeForCall(exec, callData.js.scopeChain);
    80     CodeBlock& codeBlock = callData.js.functionExecutable->generatedBytecodeForCall();
     80    CodeBlock* codeBlock = &callData.js.functionExecutable->generatedBytecodeForCall();
    8181#else
    82     CodeBlock& codeBlock = callData.js.functionExecutable->bytecodeForCall(exec, callData.js.scopeChain);
     82    CodeBlock* codeBlock = callData.js.functionExecutable->bytecodeForCall(exec, callData.js.scopeChain);
    8383#endif
    84 
    85     return codeBlock.isNumericCompareFunction();
     84    if (!codeBlock)
     85        return false;
     86
     87    return codeBlock->isNumericCompareFunction();
    8688}
    8789

  • trunk/JavaScriptCore/runtime/Executable.cpp

    r60762 r61588  
    120120}
    121121
    122 void FunctionExecutable::compileForCall(ExecState*, ScopeChainNode* scopeChainNode)
     122bool FunctionExecutable::compileForCall(ExecState*, ScopeChainNode* scopeChainNode)
    123123{
    124124    JSGlobalData* globalData = scopeChainNode->globalData;
    125125    RefPtr<FunctionBodyNode> body = globalData->parser->parse<FunctionBodyNode>(globalData, 0, 0, m_source);
     126    if (!body)
     127        return false;
    126128    if (m_forceUsesArguments)
    127129        body->setUsesArguments();
    … …  
    142144
    143145    body->destroyData();
    144 }
    145 
    146 void FunctionExecutable::compileForConstruct(ExecState*, ScopeChainNode* scopeChainNode)
     146    return true;
     147}
     148
     149bool FunctionExecutable::compileForConstruct(ExecState*, ScopeChainNode* scopeChainNode)
    147150{
    148151    JSGlobalData* globalData = scopeChainNode->globalData;
    149152    RefPtr<FunctionBodyNode> body = globalData->parser->parse<FunctionBodyNode>(globalData, 0, 0, m_source);
     153    if (!body)
     154        return false;
    150155    if (m_forceUsesArguments)
    151156        body->setUsesArguments();
    … …  
    166171
    167172    body->destroyData();
     173    return true;
    168174}
    169175
    … …  
    194200void FunctionExecutable::generateJITCodeForCall(ExecState* exec, ScopeChainNode* scopeChainNode)
    195201{
    196     CodeBlock* codeBlock = &bytecodeForCall(exec, scopeChainNode);
     202    CodeBlock* codeBlock = bytecodeForCall(exec, scopeChainNode);
    197203    m_jitCodeForCall = JIT::compile(scopeChainNode->globalData, codeBlock, &m_jitCodeForCallWithArityCheck);
    198204
    … …  
    205211void FunctionExecutable::generateJITCodeForConstruct(ExecState* exec, ScopeChainNode* scopeChainNode)
    206212{
    207     CodeBlock* codeBlock = &bytecodeForConstruct(exec, scopeChainNode);
     213    CodeBlock* codeBlock = bytecodeForConstruct(exec, scopeChainNode);
    208214    m_jitCodeForConstruct = JIT::compile(scopeChainNode->globalData, codeBlock, &m_jitCodeForConstructWithArityCheck);
    209215
    … …  
    227233{
    228234    RefPtr<FunctionBodyNode> newFunctionBody = globalData->parser->parse<FunctionBodyNode>(globalData, 0, 0, m_source);
     235    if (!newFunctionBody)
     236        return 0;
    229237    if (m_forceUsesArguments)
    230238        newFunctionBody->setUsesArguments();
    … …  
    256264{
    257265    RefPtr<EvalNode> newEvalBody = globalData->parser->parse<EvalNode>(globalData, 0, 0, m_source);
     266    if (!newEvalBody)
     267        return 0;
    258268
    259269    ScopeChain scopeChain(scopeChainNode);

  • trunk/JavaScriptCore/runtime/Executable.h

    r60376 r61588  
    306306        }
    307307
    308         FunctionCodeBlock& bytecodeForCall(ExecState* exec, ScopeChainNode* scopeChainNode)
     308        FunctionCodeBlock* bytecodeForCall(ExecState* exec, ScopeChainNode* scopeChainNode)
    309309        {
    310310            ASSERT(scopeChainNode);
    311311            if (!m_codeBlockForCall)
    312312                compileForCall(exec, scopeChainNode);
    313             return *m_codeBlockForCall;
     313            return m_codeBlockForCall;
    314314        }
    315315
    … …  
    325325        }
    326326
    327         FunctionCodeBlock& bytecodeForConstruct(ExecState* exec, ScopeChainNode* scopeChainNode)
     327        FunctionCodeBlock* bytecodeForConstruct(ExecState* exec, ScopeChainNode* scopeChainNode)
    328328        {
    329329            ASSERT(scopeChainNode);
    330330            if (!m_codeBlockForConstruct)
    331331                compileForConstruct(exec, scopeChainNode);
    332             return *m_codeBlockForConstruct;
     332            return m_codeBlockForConstruct;
    333333        }
    334334
    … …  
    384384        }
    385385
    386         void compileForCall(ExecState*, ScopeChainNode*);
    387         void compileForConstruct(ExecState*, ScopeChainNode*);
     386        bool compileForCall(ExecState*, ScopeChainNode*);
     387        bool compileForConstruct(ExecState*, ScopeChainNode*);
    388388
    389389        unsigned m_numVariables : 31;

  • trunk/JavaScriptCore/runtime/JSGlobalData.cpp

    r59746 r61588  
    247247        initializingLazyNumericCompareFunction = true;
    248248        RefPtr<FunctionExecutable> function = FunctionExecutable::fromGlobalCode(Identifier(exec, "numericCompare"), exec, 0, makeSource(UString("(function (v1, v2) { return v1 - v2; })")), 0, 0);
    249         lazyNumericCompareFunction = function->bytecodeForCall(exec, exec->scopeChain()).instructions();
     249        lazyNumericCompareFunction = function->bytecodeForCall(exec, exec->scopeChain())->instructions();
    250250        initializingLazyNumericCompareFunction = false;
    251251    }
Note: See TracChangeset for help on using the changeset viewer.