[webkit-reviews] review granted: [Bug 118498] ASSERTION FAILED: callFrame == vm->topCallFrame || callFrame == callFrame->lexicalGlobalObject()->globalExec() || callFrame == callFrame->dynamicGlobalObject()->globalExec() in JSC::Interpreter::addStackTraceIfNecessary : [Attachment 206999] patch6

[bugzilla-daemon at webkit.org]

Geoffrey Garen <ggaren at apple.com> has granted Chris Curtis
<chris_curtis at apple.com>'s request for review:
Bug 118498: ASSERTION FAILED: callFrame == vm->topCallFrame || callFrame ==
callFrame->lexicalGlobalObject()->globalExec() || callFrame ==
callFrame->dynamicGlobalObject()->globalExec() in
JSC::Interpreter::addStackTraceIfNecessary
https://bugs.webkit.org/show_bug.cgi?id=118498

Attachment 206999: patch6
https://bugs.webkit.org/attachment.cgi?id=206999&action=review

------- Additional Comments from Geoffrey Garen <ggaren at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=206999&action=review


r=me

> Source/JavaScriptCore/ChangeLog:16
> +	   Created new throwExceptionFromOpCall that takes in a functor that
contains
> +	   a function pointer (to create the errorObject) instead of a JSValue.
Inside
> +	   of throwExceptionFromOpCall the topCallFrame is being rolled back in
order
> +	   to handle the error throw. By passing the function pointer in, we
can defer
> +	   the creation of the error object until after topCallFrame has been
rolled 
> +	   back. This allows the error object to be created with the
appropriate top 
> +	   frame.

This explanation is much improved from the original!