Skip to content
  • fpizlo@apple.com's avatar
    REGRESSION (r138921): Crash in JSC::Arguments::create · 608ecbe4
    fpizlo@apple.com authored
    https://bugs.webkit.org/show_bug.cgi?id=106329
    <rdar://problem/12974196>
    
    Source/JavaScriptCore: 
    
    Reviewed by Mark Hahnenberg.
            
    Arguments::finishCreation() that takes an InlineCallFrame* needs to understand that the callee can
    be unset, indicating that the callee needs to be loaded from the true call frame. This adds a
    method to InlineCallFrame to do just that.
    
    * bytecode/CodeOrigin.cpp:
    (JSC::InlineCallFrame::calleeForCallFrame):
    * bytecode/CodeOrigin.h:
    (InlineCallFrame):
    * runtime/Arguments.h:
    (JSC::Arguments::finishCreation):
    
    LayoutTests: 
    
    Reviewed by Mark Hahnenberg.
    
    * fast/js/dfg-create-inlined-arguments-in-closure-inline-expected.txt: Added.
    * fast/js/dfg-create-inlined-arguments-in-closure-inline.html: Added.
    * fast/js/jsc-test-list:
    * fast/js/script-tests/dfg-create-inlined-arguments-in-closure-inline.js: Added.
    (foo):
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@139109 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    608ecbe4