Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-03-02 22:37:50 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1019810: Crashing in InlineFrameIterator::findNextFrame() with MOZ_CRASH when numActualArgs_ fails to get initialized, r=h4writer

Browse Source
This commit is contained in:
Amit Tripathi 2014-08-25 17:55:27 +05:30
parent e49b1d978d
commit 995b8b1c13
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
js/src/jit/IonFrames.cpp
View File

@ -1875,9 +1875,7 @@ InlineFrameIterator::findNextFrame()
si_.settleOnFrame();
pc_ = script_->offsetToPC(si_.pcOffset());
#ifdef DEBUG
numActualArgs_ = 0xbadbad;
#endif
// This unfortunately is O(n*m), because we must skip over outer frames
// before reading inner ones.
@ -1904,7 +1902,8 @@ InlineFrameIterator::findNextFrame()
numActualArgs_ = 1;
}
JS_ASSERT(numActualArgs_ != 0xbadbad);
if (numActualArgs_ == 0xbadbad)
MOZ_CRASH("Couldn't deduce the number of arguments of an ionmonkey frame");
// Skip over non-argument slots, as well as |this|.
unsigned skipCount = (si_.numAllocations() - 1) - numActualArgs_ - 1;