Please sign in to comment.
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
We should not crash there is a finally inside a for-in loop
https://bugs.webkit.org/show_bug.cgi?id=159243 <rdar://problem/27018910> Reviewed by Benjamin Poulain. Previously we would swap the m_forInContext with an empty vector then attempt to shrink the size of m_forInContext by the amount we expected. This meant that if there was more than one ForInContext on the stack and we wanted to pop exactly one off we would crash. This patch makes ForInContexts RefCounted so they can be duplicated into other vectors. It also has ForInContexts copy the entire stack rather than do the swap that we did before. This makes ForInContexts work the same as the other contexts. * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitComplexPopScopes): (JSC::BytecodeGenerator::pushIndexedForInScope): (JSC::BytecodeGenerator::pushStructureForInScope): * bytecompiler/BytecodeGenerator.h: * tests/stress/finally-for-in.js: Added. (repeat): (createSimple): Canonical link: https://commits.webkit.org/177355@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@202608 268f45cc-cd09-0410-ab3c-d52691b4dbfc
- Loading branch information
Showing with 72 additions and 7 deletions.