Bug 26532 – Native functions do not correctly unlink from optimised callsites when they're collected

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Oliver Hunt]

Native functions are not correctly unlinking from optimised callsites when they're collected, which may result in a crash if a new object is subsequently allocated at the same address, and is then called at the optimised call location.

[Oliver Hunt]

Created attachment 31533 [details]
Fixeration

[Gavin Barraclough]

Comment on attachment 31533 [details]
Fixeration

Please to be adding ASSERTs to check code type enum is sizeof(int32_t), and add ASSERTSs to cti_op_call_JSFunction & the arity check to the function is not a host function.

Also, in the ChangeLog you say 'Reviewed by NOBODY (OOPS!).', this should read 'Reviewed by Gavin "Viceroy of Venezuela" Barraclough.'.

r+.
G.

[Oliver Hunt]

Committing to http://svn.webkit.org/repository/webkit/trunk ...
	M	JavaScriptCore/ChangeLog
	M	JavaScriptCore/JavaScriptCore.exp
	M	JavaScriptCore/bytecode/CodeBlock.cpp
	M	JavaScriptCore/bytecode/CodeBlock.h
	M	JavaScriptCore/jit/JIT.cpp
	M	JavaScriptCore/jit/JITStubs.cpp
	M	JavaScriptCore/parser/Nodes.cpp
	M	JavaScriptCore/parser/Nodes.h
	M	JavaScriptCore/runtime/JSFunction.cpp
	M	JavaScriptCore/runtime/JSGlobalData.cpp
	M	JavaScriptCore/runtime/JSGlobalData.h
Committed r44844

[David Levin]

Corresponding Windows build fix http://trac.webkit.org/changeset/44845.