diff options
| author | Lucas Forschler <lforschler@apple.com> | 2014-10-22 15:05:00 +0200 |
|---|---|---|
| committer | Oswald Buddenhagen <oswald.buddenhagen@theqtcompany.com> | 2014-10-31 11:30:36 +0100 |
| commit | 0930236a6e8bef5c2b90f1522a06acf9dee9c15d (patch) | |
| tree | f29fdddc342150ce743d288053ff10fdc30258e3 /Source/JavaScriptCore | |
| parent | 946088cf515ec30de586392ec72e4658b86650a4 (diff) | |
| download | qtwebkit-5.3.tar.gz | |
Fix assert after makerope boundary check5.3
The browser demo asserts on qt-project.org after the makerope security
fix.
Port of http://trac.webkit.org/changeset/169397
Change-Id: I19c98737735d9b17133742752928d4ce6349de13
Reviewed-by: Michael Bruning <michael.bruning@digia.com>
Diffstat (limited to 'Source/JavaScriptCore')
| -rw-r--r-- | Source/JavaScriptCore/dfg/DFGAbstractState.cpp | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp index ab2a5af98..ad4e84198 100644 --- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp +++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp @@ -476,6 +476,7 @@ bool AbstractState::executeEffects(unsigned indexInBlock, Node* node) } case MakeRope: { + node->setCanExit(true); forNode(node).set(m_graph.m_vm.stringStructure.get()); break; } |