Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-19 08:15:31 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1207572 - Make sure idempotent caches are invalidated when getting the non-int32 length of an array, r=jandem.

Browse Source
This commit is contained in:
Brian Hackett 2015-10-05 10:00:47 -06:00
parent 4e41796a57
commit c7546357ff
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
js/src/jit/IonCaches.cpp
View File

@ -1259,6 +1259,13 @@ IsCacheableArrayLength(JSContext* cx, HandleObject obj, HandlePropertyName name,
return false;
}
// The emitted stub can only handle int32 lengths. If the length of the
// actual object does not fit in an int32 then don't attach a stub, as if
// the cache is idempotent we won't end up invalidating the compiled script
// otherwise.
if (obj->as<ArrayObject>().length() > INT32_MAX)
return false;
return true;
}