Bug 104313

Summary: Incorrect inequality for checking whether a statement is within bounds of a handler
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: barraclough, ggaren, mark.lam, mhahnenberg, msaboff, oliver, sam
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
the patch ggaren: review+

Filip Pizlo
Reported 2012-12-06 16:22:03 PST
currentIndex <= end is not correct since end is exclusive rather than inclusive: it's the next instruction after the end of the try. This never failed prior to my jsc upheaval because back then, the next instruction after a try was always a catch, which never threw. But now the next instruction may be the start of an inlined finally block for the case where finally would be "called" from the tail of the try.
Attachments
the patch (14.19 KB, patch)
2012-12-06 16:37 PST, Filip Pizlo 		ggaren: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2012-12-06 16:26:30 PST
<rdar://problem/12808934>
Filip Pizlo
Comment 2 2012-12-06 16:37:56 PST
Created attachment 178106 [details] the patch
Geoffrey Garen
Comment 3 2012-12-06 17:18:08 PST
Comment on attachment 178106 [details] the patch r=me
Filip Pizlo
Comment 4 2012-12-06 23:45:39 PST
Landed in http://trac.webkit.org/changeset/136927
Note You need to log in before you can comment on or make changes to this bug.