[Webkit-unassigned] [Bug 19044] SquirrelFish: Bogus values enter evaluation when closing over scope with parameter and var with same name

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed May 14 09:12:14 PDT 2008


http://bugs.webkit.org/show_bug.cgi?id=19044





------- Comment #2 from ggaren at apple.com  2008-05-14 09:12 PDT -------
I believe the error is in JSActivation::copyRegisters:

    int numRegisters = symbolTable().size();

In the case of duplicate entries, the symbol table's size will not equal the
number of local registers. I believe the correct behavior is to set
numRegisters to CodeBlock::numLocals instead.

There are other, more complicated ways to fix this. For example, codegen
changes could ensure exact local register allocation, such that we packed all
duplicates into the same slot. I had a patch to do that a while back.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.



More information about the webkit-unassigned mailing list