Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-04 19:33:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 493177 - Browser crashes in loading of certain page.[@ js_Interpret] (r=mrbkap).

Browse Source
This commit is contained in:
Brendan Eich 2009-05-15 17:13:34 -07:00
parent 9e84859560
commit 5648bbb12a
1 changed files with 19 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
js/src/jsemit.cpp
View File

@ -1847,10 +1847,26 @@ MakeUpvarForEval(JSParseNode *pn, JSCodeGenerator *cg)
uintN upvarLevel = fun->u.i.script->staticLevel;
JSFunctionBox *funbox = cg->funbox;
while (funbox && funbox->level >= upvarLevel) {
if (funbox->node->pn_dflags & PND_FUNARG)
if (funbox) {
/*
* Treat top-level function definitions as escaping (i.e., as funargs),
* required since we compile each such top level function or statement
* and throw away the AST, so we can't yet see all funarg uses of this
* function being compiled (cg->funbox->object). See bug 493177.
*/
if (funbox->level == fun->u.i.script->staticLevel + 1U &&
!(((JSFunction *) funbox->object)->flags & JSFUN_LAMBDA)) {
JS_ASSERT(((JSFunction *) funbox->object)->atom);
return true;
funbox = funbox->parent;
}
while (funbox->level >= upvarLevel) {
if (funbox->node->pn_dflags & PND_FUNARG)
return true;
funbox = funbox->parent;
if (!funbox)
break;
}
}
JSContext *cx = cg->compiler->context;