[Webkit-unassigned] [Bug 40293] New: Fix the length of instruction stream controlled by constant pool

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Tue Jun 8 05:48:28 PDT 2010


https://bugs.webkit.org/show_bug.cgi?id=40293

           Summary: Fix the length of instruction stream controlled by
                    constant pool
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Other
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: loki at webkit.org
                CC: barraclough at apple.com


In AssemblerBufferWithConstantPool the initial/maximum length of instruction stream (m_maxDistance) was set by the constructor and the flushConstantPool, but the m_maxDistance was decreased by all put functions. Although there is no problem when the m_maxDistance is a negative value while the number of constant is zero. If a constant is placed onto the pool while the m_maxDistance is negative, the flushConstantPool will be invoked. This is not correct. The m_maxDistance should be set when the first constant arrives.

It can lead to an error. If an uninterrupted sequence comes after m_maxDistance is negative and number of constant is zero, the pool will be placed into the sequence.

I am going to upload a fix for this.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.



More information about the webkit-unassigned mailing list