diff --git a/src/deoptimizer.h b/src/deoptimizer.h index ccd5e48954..a53de3da98 100644 --- a/src/deoptimizer.h +++ b/src/deoptimizer.h @@ -326,7 +326,9 @@ class FrameDescription { JSFunction* function); void* operator new(size_t size, uint32_t frame_size) { - return malloc(size + frame_size); + // Subtracts kPointerSize, as the member frame_content_ already supplies + // the first element of the area to store the frame. + return malloc(size + frame_size - kPointerSize); } void operator delete(void* description) { @@ -410,7 +412,7 @@ class FrameDescription { } static int frame_content_offset() { - return sizeof(FrameDescription); + return OFFSET_OF(FrameDescription, frame_content_); } private: @@ -429,6 +431,10 @@ class FrameDescription { // deoptimizing. intptr_t continuation_; + // This must be at the end of the object as the object is allocated larger + // than it's definition indicate to extend this array. + intptr_t frame_content_[1]; + intptr_t* GetFrameSlotPointer(unsigned offset) { ASSERT(offset < frame_size_); return reinterpret_cast(