Skip to content
  • cwzwarich@webkit.org's avatar
    2009-01-29 Cameron Zwarich <cwzwarich@uwaterloo.ca> · fc02a0c2
    cwzwarich@webkit.org authored
            Reviewed by Oliver Hunt.
    
            Bug 23551: Crash on page load with profiler enabled and running
            <https://bugs.webkit.org/show_bug.cgi?id=23551>
            <rdar://problem/6529521>
    
            Interpreter::execute(FunctionBodyNode*, ...) calls Profiler::didExecute()
            with a stale CallFrame. If some part of the scope chain has already been
            freed, Profiler::didExecute() will crash when attempting to get the lexical
            global object. The fix is to make the didExecute() call use the caller's
            CallFrame, not the one made for the function call. In this case, the
            willExecute() call should also be changed to match.
    
            Since this occurs in the actual inspector JS, it is difficult to reduce.
            I couldn't make a layout test.
    
            * interpreter/Interpreter.cpp:
            (JSC::Interpreter::execute):
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@40396 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    fc02a0c2