diff options
| -rw-r--r-- | src/3rdparty/webkit/JavaScriptCore/ChangeLog | 12 | ||||
| -rw-r--r-- | src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp | 2 |
2 files changed, 13 insertions, 1 deletions
diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog index c09ad79..2be6f5a 100644 --- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog +++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog @@ -1,3 +1,15 @@ +2010-07-08 Andreas Kling <andreas.kling@nokia.com> + + Reviewed by Oliver Hunt. + + Interpreter: Crash in op_load_varargs on 64-bit + https://bugs.webkit.org/show_bug.cgi?id=41795 + + Added missing cast of argCount to int32_t in op_load_varargs. + + * interpreter/Interpreter.cpp: + (JSC::Interpreter::privateExecute): + 2010-07-02 Peter Varga <pvarga@inf.u-szeged.hu> Reviewed by Oliver Hunt. diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp index 9e2e788..a56040c 100644 --- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp +++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp @@ -3475,7 +3475,7 @@ skip_id_custom_self: argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams]; // Then we copy any additional arguments that may be further up the stack ('-1' to account for 'this') for (; i < static_cast<int32_t>(argCount); i++) - argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams - argCount - 1]; + argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams - static_cast<int32_t>(argCount) - 1]; } else if (!arguments.isUndefinedOrNull()) { if (!arguments.isObject()) { exceptionValue = createInvalidParamError(callFrame, "Function.prototype.apply", arguments, vPC - callFrame->codeBlock()->instructions().begin(), callFrame->codeBlock()); |