Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-14 22:05:44 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1089761 - Initialize lexicals to throw on touch on CallObject templates. (r=jandem)

Browse Source
This commit is contained in:
Shu-yu Guo 2014-10-29 12:57:31 -07:00
parent 8b6411868d
commit c0eb4fc985
3 changed files with 20 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
js/src/jit-test/tests/ion/bug1089761.js Normal file
View File

@ -0,0 +1,14 @@
var hits = 0;
for (var j = 0; j < 9; ++j) {
try {
(function() {
(function() {
eval("x")
let x
})()
})()
} catch (e) {
hits++;
}
}
assertEq(hits, 9);

4
js/src/vm/ScopeObject-inl.h
View File

@ -57,9 +57,9 @@ inline void
CallObject::setAliasedLexicalsToThrowOnTouch(JSScript *script)
{
uint32_t aliasedLexicalBegin = script->bindings.aliasedBodyLevelLexicalBegin();
uint32_t aliasedLexicalEnd = numFixedSlots();
uint32_t aliasedLexicalEnd = slotSpan();
for (uint32_t slot = aliasedLexicalBegin; slot < aliasedLexicalEnd; slot++)
initFixedSlot(slot, MagicValue(JS_UNINITIALIZED_LEXICAL));
initSlot(slot, MagicValue(JS_UNINITIALIZED_LEXICAL));
}
template <AllowGC allowGC>

5
js/src/vm/ScopeObject.cpp
View File

@ -198,6 +198,10 @@ CallObject::createTemplateObject(JSContext *cx, HandleScript script, gc::Initial
if (!obj)
return nullptr;
// Set uninitialized lexicals even on template objects, as Ion will
// copy over the template object's slot values in the fast path.
obj->as<CallObject>().setAliasedLexicalsToThrowOnTouch(script);
return &obj->as<CallObject>();
}
@ -217,7 +221,6 @@ CallObject::create(JSContext *cx, HandleScript script, HandleObject enclosing, H
callobj->as<ScopeObject>().setEnclosingScope(enclosing);
callobj->initFixedSlot(CALLEE_SLOT, ObjectOrNullValue(callee));
callobj->setAliasedLexicalsToThrowOnTouch(script);
if (script->treatAsRunOnce()) {
Rooted<CallObject*> ncallobj(cx, callobj);