Changeset 92804 in webkit

Timestamp:

Aug 10, 2011 5:17:05 PM (13 years ago)

Author:

fpizlo@apple.com

Message:

REGRESSION(r92670-r92744): WebKit crashes when opening Gmail
​https://bugs.webkit.org/show_bug.cgi?id=66010

Reviewed by Oliver Hunt.

Made sure that Construct calls use() on the this argument.

• dfg/DFGJITCodeGenerator.cpp:

(JSC::DFG::JITCodeGenerator::emitCall):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGJITCodeGenerator.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-08-10  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION(r92670-r92744): WebKit crashes when opening Gmail
+        https://bugs.webkit.org/show_bug.cgi?id=66010
+
+        Reviewed by Oliver Hunt.
+        
+        Made sure that Construct calls use() on the this argument.
+
+        * dfg/DFGJITCodeGenerator.cpp:
+        (JSC::DFG::JITCodeGenerator::emitCall):
+
 2011-08-10  Mark Hahnenberg  <mhahnenberg@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGJITCodeGenerator.cpp

@@ -1000 +1000 @@
     m_jit.storePtr(GPRInfo::callFrameRegister, addressOfCallData(RegisterFile::CallerFrame));
     
+    if (node.op == Construct)
+        use(m_jit.graph().m_varArgChildren[node.firstChild() + 1]);
+    
     for (int argIdx = (node.op == Call ? 0 : 1); argIdx < numArgs; argIdx++) {
         NodeIndex argNodeIndex = m_jit.graph().m_varArgChildren[node.firstChild() + 1 + argIdx];