Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-10 20:05:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 852174 - Fix bogus asserts, r=jandem.

Browse Source
This commit is contained in:
Brian Hackett 2013-03-19 08:50:31 -06:00
parent 9eb583de8e
commit 3b7ef11f1b
3 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
js/src/ion/Bailouts.cpp
View File

@ -192,8 +192,7 @@ PushInlinedFrame(JSContext *cx, StackFrame *callerFrame)
// which will not be the case when we inline getters (in which case it would be a
// JSOP_GETPROP). That will have to be handled differently.
FrameRegs &regs = cx->regs();
JS_ASSERT(JSOp(*regs.pc) == JSOP_CALL || JSOp(*regs.pc) == JSOP_NEW ||
JSOp(*regs.pc) == JSOP_FUNAPPLY);
JS_ASSERT(js_CodeSpec[*regs.pc].format & JOF_INVOKE);
int callerArgc = GET_ARGC(regs.pc);
if (JSOp(*regs.pc) == JSOP_FUNAPPLY)
callerArgc = callerFrame->nactual();

9
js/src/jit-test/tests/ion/bug852174.js Normal file
View File

@ -0,0 +1,9 @@
function eval()
isPrototypeOf[Iterator.length]
function DoWhile_3()
eval();
DoWhile_3();
function f()
DoWhile_3(f - 0);
for (var i in f());

3
js/src/jsinterp.cpp
View File

@ -1562,8 +1562,7 @@ BEGIN_CASE(JSOP_STOP)
cx->stack.popInlineFrame(regs);
SET_SCRIPT(regs.fp()->script());
JS_ASSERT(*regs.pc == JSOP_NEW || *regs.pc == JSOP_CALL ||
*regs.pc == JSOP_FUNCALL || *regs.pc == JSOP_FUNAPPLY);
JS_ASSERT(js_CodeSpec[*regs.pc].format & JOF_INVOKE);
/* Resume execution in the calling frame. */
if (JS_LIKELY(interpReturnOK)) {