Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-01 14:45:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 500580 - JS_CallFunction path isn't ~JIT guarded against non-global scope chains, r=brendan.

Browse Source
This commit is contained in:
Graydon Hoare 2009-06-26 11:13:32 -07:00
parent b44a5e1940
commit 608ab1827c
1 changed files with 21 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
js/src/jsinterp.cpp
View File

@ -1448,6 +1448,17 @@ js_InternalInvoke(JSContext *cx, JSObject *obj, jsval fval, uintN flags,
JSBool ok;
js_LeaveTrace(cx);
#ifdef JS_TRACER
/*
* The JIT requires that the scope chain here is equal to its global
* object. Disable the JIT for this call if this condition is not true.
*/
uint32 oldOptions = cx->options;
if ((oldOptions & JSOPTION_JIT) && obj != JS_GetGlobalForObject(cx, obj))
cx->options &= ~JSOPTION_JIT;
#endif
invokevp = js_AllocStack(cx, 2 + argc, &mark);
if (!invokevp)
return JS_FALSE;
@ -1477,6 +1488,13 @@ js_InternalInvoke(JSContext *cx, JSObject *obj, jsval fval, uintN flags,
}
js_FreeStack(cx, mark);
#ifdef JS_TRACER
/* Possibly re-enable JIT, if disabled above. */
if (oldOptions & JSOPTION_JIT)
cx->options |= JSOPTION_JIT;
#endif
return ok;
}
@ -1536,15 +1554,12 @@ js_Execute(JSContext *cx, JSObject *chain, JSScript *script,
#ifdef JS_TRACER
/*
* The JIT requires that the scope chain here is equal to
* its global object. Disable the JIT for this call if this
* condition is not true.
* The JIT requires that the scope chain here is equal to its global
* object. Disable the JIT for this call if this condition is not true.
*/
uint32 oldOptions = cx->options;
if ((oldOptions & JSOPTION_JIT) &&
chain != JS_GetGlobalForObject(cx, chain)) {
if ((oldOptions & JSOPTION_JIT) && chain != JS_GetGlobalForObject(cx, chain))
cx->options &= ~JSOPTION_JIT;
}
#endif
#ifdef INCLUDE_MOZILLA_DTRACE