Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-24 10:45:42 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 885976 - Make ScriptFrameIter::numFrameSlots() a bit more robust. r=luke

Browse Source
This commit is contained in:
Jan de Mooij 2013-06-24 18:44:22 +02:00
parent 64a8beb86e
commit 356866d0f4
2 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
js/src/jit-test/tests/asm.js/bug885976.js Normal file
View File

@ -0,0 +1,12 @@
// |jit-test| error: TypeError
function test(stdlib, foreign) {
"use asm"
var ff = foreign.ff
function f(y) {
y = +y;
ff(0);
}
return f;
};
f = test(this, {ff: Object.preventExtensions});
f();

5
js/src/vm/Stack.cpp
View File

@ -1216,9 +1216,8 @@ ScriptFrameIter::numFrameSlots() const
#endif
}
case SCRIPTED:
JS_ASSERT(data_.cx_);
JS_ASSERT(data_.cx_->interpreterRegs().spForStackDepth(0) == interpFrame()->base());
return data_.cx_->interpreterRegs().sp - interpFrame()->base();
JS_ASSERT(data_.interpFrames_.sp() >= interpFrame()->base());
return data_.interpFrames_.sp() - interpFrame()->base();
}
JS_NOT_REACHED("Unexpected state");
return 0;