Bug 82947

Summary:

Activation tear-off neglects to copy the callee and scope chain, leading to crashes if we try to create an arguments object from the activation

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

JavaScriptCore

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

Keywords:

InRadar

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Attachments:

Description	Flags
the patch	none

Description Filip Pizlo 2012-04-02 14:27:46 PDT

Patch forthcoming.

<rdar://problem/11058598>

Comment 1 Filip Pizlo 2012-04-02 14:29:26 PDT

Created attachment 135186 [details]
the patch

Comment 2 Filip Pizlo 2012-04-02 14:52:00 PDT

Reviewed by Gavin in person.

Comment 3 Filip Pizlo 2012-04-02 14:53:39 PDT

Landed in http://trac.webkit.org/changeset/112947