mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-22 17:55:50 +00:00
4192db83c2
The ObjLiteral format allows for names (as atom indices) or numeric
indices to be attached to each property in the literal. The numeric case
is limited to 23 bits by the packed format in memory.
The object-literal case ({}-literal with some numeric indices) already
checks for in-range values before deciding to use the ObjLiteral
infrastructure, but the array case did not check this.
Fortunately, the indices in the array case were only used as a sanity
check for debug-mode assertions, and never for any actual indexing
operation, so no out-of-bounds behavior could result, even before this
fix. However, the sanity-check assert will fire at
object-construction-from-ObjLiteral time in cases where the ObjLiteral
mode should not have been used, because no range check was done at
ObjLiteral-construction time.
This change removes the use of indices for array-mode ObjLiterals
entirely.
Differential Revision: https://phabricator.services.mozilla.com/D60474
--HG--
extra : moz-landing-system : lando
|
||
|---|---|---|
| .. | ||
| ductwork/debugger | ||
| examples | ||
| ipc | ||
| public | ||
| rust | ||
| src | ||
| xpconnect | ||
| app.mozbuild | ||
| ffi.configure | ||
| moz.build | ||
| moz.configure | ||
| sub.configure | ||