mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
[INFER] Don't emit malformed eleminc ops when incrementing XML names, bug 672153.
This commit is contained in:
parent
f67df11928
commit
012ece7c31
1
js/src/jit-test/tests/basic/bug672153.js
Normal file
1
js/src/jit-test/tests/basic/bug672153.js
Normal file
@ -0,0 +1 @@
|
||||
uneval(Function("[] = (*::*++);print(x);"));
|
@ -3144,8 +3144,13 @@ EmitElemOp(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg)
|
||||
static bool
|
||||
EmitElemIncDec(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg)
|
||||
{
|
||||
if (!EmitElemOp(cx, pn, op, cg))
|
||||
return false;
|
||||
if (pn) {
|
||||
if (!EmitElemOp(cx, pn, op, cg))
|
||||
return false;
|
||||
} else {
|
||||
if (!EmitElemOpBase(cx, cg, op))
|
||||
return false;
|
||||
}
|
||||
if (js_Emit1(cx, cg, JSOP_NOP) < 0)
|
||||
return false;
|
||||
|
||||
@ -6583,18 +6588,17 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
|
||||
}
|
||||
if (js_Emit1(cx, cg, op) < 0)
|
||||
return JS_FALSE;
|
||||
if (js_CodeSpec[op].format & JOF_DECOMPOSE) {
|
||||
/*
|
||||
* This is dead code for the decompiler, don't generate
|
||||
* a decomposed version of the opcode. We do need to balance
|
||||
* the stacks in the decomposed version.
|
||||
*/
|
||||
JS_ASSERT(js_CodeSpec[op].format & JOF_ELEM);
|
||||
if (js_Emit1(cx, cg, (JSOp)1) < 0)
|
||||
return JS_FALSE;
|
||||
if (js_Emit1(cx, cg, JSOP_POP) < 0)
|
||||
return JS_FALSE;
|
||||
}
|
||||
/*
|
||||
* This is dead code for the decompiler, don't generate
|
||||
* a decomposed version of the opcode. We do need to balance
|
||||
* the stacks in the decomposed version.
|
||||
*/
|
||||
JS_ASSERT(js_CodeSpec[op].format & JOF_DECOMPOSE);
|
||||
JS_ASSERT(js_CodeSpec[op].format & JOF_ELEM);
|
||||
if (js_Emit1(cx, cg, (JSOp)1) < 0)
|
||||
return JS_FALSE;
|
||||
if (js_Emit1(cx, cg, JSOP_POP) < 0)
|
||||
return JS_FALSE;
|
||||
break;
|
||||
#if JS_HAS_XML_SUPPORT
|
||||
case TOK_UNARYOP:
|
||||
@ -6603,7 +6607,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
|
||||
return JS_FALSE;
|
||||
if (js_Emit1(cx, cg, JSOP_BINDXMLNAME) < 0)
|
||||
return JS_FALSE;
|
||||
if (js_Emit1(cx, cg, op) < 0)
|
||||
if (!EmitElemIncDec(cx, NULL, op, cg))
|
||||
return JS_FALSE;
|
||||
break;
|
||||
#endif
|
||||
|
Loading…
Reference in New Issue
Block a user