[webkit-reviews] review requested: [Bug 16868] Gmail crash : [Attachment 18461] Revised proposed patch

[bugzilla-daemon at webkit.org]

Cameron Zwarich (cpst) <cwzwarich at uwaterloo.ca> has asked  for review:
Bug 16868: Gmail crash
http://bugs.webkit.org/show_bug.cgi?id=16868

Attachment 18461: Revised proposed patch
http://bugs.webkit.org/attachment.cgi?id=18461&action=edit

------- Additional Comments from Cameron Zwarich (cpst)
<cwzwarich at uwaterloo.ca>
Here is an updated version of the patch. It is less convoluted than before,
maybe uses a few more branches in the bad case, and properly deals with the
situation where there are multiple ExecStates down the callingExec chain that
have distinct savedExec's (can this ever actually happen?).

(In reply to comment #14)
> Can you add a regression test to this patch? Typically, we require regression

> fixes to include test cases demonstrating the fix.

I should be able to make a layout test that shows the problems with
cross-window eval(). I am not sure about the others. In theory, I should also
be able to force a crash with the m_savedExec != m_calledExec situation by
explicitly asking for a GC every other line. I will try to have at least one
test soon.