Activation tear-off neglects to copy the callee and scope chain, leading to crashes...

try to create an arguments object from the activation
https://bugs.webkit.org/show_bug.cgi?id=82947
<rdar://problem/11058598>

Reviewed by Gavin Barraclough.

We now copy the entire call frame header just to be sure. This is mostly perf-netural,
except for a 3.7% slow-down in V8/earley.

* runtime/JSActivation.cpp:
(JSC::JSActivation::visitChildren):
* runtime/JSActivation.h:
(JSC::JSActivation::tearOff):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@112947 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index ccbdb3f..9538609 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,20 @@
+2012-04-02  Filip Pizlo  <fpizlo@apple.com>
+
+        Activation tear-off neglects to copy the callee and scope chain, leading to crashes if we
+        try to create an arguments object from the activation
+        https://bugs.webkit.org/show_bug.cgi?id=82947
+        <rdar://problem/11058598>
+
+        Reviewed by Gavin Barraclough.
+        
+        We now copy the entire call frame header just to be sure. This is mostly perf-netural,
+        except for a 3.7% slow-down in V8/earley.
+
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::visitChildren):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::tearOff):
+
 2012-04-02  Daniel Bates  <dbates@webkit.org>
 
         Remove Source/JavaScriptCore/wtf and its empty subdirectories

diff --git a/Source/JavaScriptCore/runtime/JSActivation.cpp b/Source/JavaScriptCore/runtime/JSActivation.cpp
index 3e05738..f6f76d6 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSActivation.cpp
+++ b/Source/JavaScriptCore/runtime/JSActivation.cpp
@@ -78,11 +78,15 @@ void JSActivation::visitChildren(JSCell* cell, SlotVisitor& visitor)
     WriteBarrier<Unknown>* registerArray = thisObject->m_registerArray.get();
     if (!registerArray)
         return;
-
+    
     visitor.appendValues(registerArray, thisObject->m_numCapturedArgs);
 
-    // Skip 'this' and call frame.
-    visitor.appendValues(registerArray + CallFrame::offsetFor(thisObject->m_numCapturedArgs + 1), thisObject->m_numCapturedVars);
+    // Skip 'this' and call frame, except for callee and scope chain.
+    int offset = CallFrame::offsetFor(thisObject->m_numCapturedArgs + 1);
+    visitor.append(registerArray + offset + RegisterFile::ScopeChain);
+    visitor.append(registerArray + offset + RegisterFile::Callee);
+    
+    visitor.appendValues(registerArray + offset, thisObject->m_numCapturedVars);
 }
 
 inline bool JSActivation::symbolTableGet(const Identifier& propertyName, PropertySlot& slot)

diff --git a/Source/JavaScriptCore/runtime/JSActivation.h b/Source/JavaScriptCore/runtime/JSActivation.h
index 80c8aa8..f267664 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSActivation.h
+++ b/Source/JavaScriptCore/runtime/JSActivation.h
@@ -127,16 +127,9 @@ namespace JSC {
         OwnArrayPtr<WriteBarrier<Unknown> > registerArray = adoptArrayPtr(new WriteBarrier<Unknown>[registerArraySize]);
         WriteBarrier<Unknown>* registers = registerArray.get() + registerOffset;
 
-        // Copy all arguments that can be captured by name or by the arguments object.
-        for (int i = 0; i < m_numCapturedArgs; ++i) {
-            int index = CallFrame::argumentOffset(i);
-            registers[index].set(globalData, this, m_registers[index].get());
-        }
-
-        // Skip 'this' and call frame.
-
-        // Copy all captured vars.
-        for (int i = 0; i < m_numCapturedVars; ++i)
+        int from = CallFrame::argumentOffset(m_numCapturedArgs - 1);
+        int to = m_numCapturedVars;
+        for (int i = from; i < to; ++i)
             registers[i].set(globalData, this, m_registers[i].get());
 
         setRegisters(registers, registerArray.release());