wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

[INFER] Don't emit malformed eleminc ops when incrementing XML names, bug 672153.

Browse Source
This commit is contained in:
Brian Hackett 2011-07-21 21:27:23 -07:00
parent f67df11928
commit 012ece7c31
2 changed files with 20 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
js/src/jit-test/tests/basic/bug672153.js Normal file
View File

@ -0,0 +1 @@
uneval(Function("[] = (*::*++);print(x);"));

10
js/src/jsemit.cpp
View File

@ -3144,8 +3144,13 @@ EmitElemOp(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg)
static bool
EmitElemIncDec(JSContext *cx, JSParseNode *pn, JSOp op, JSCodeGenerator *cg)
{
if (pn) {
if (!EmitElemOp(cx, pn, op, cg))
return false;
} else {
if (!EmitElemOpBase(cx, cg, op))
return false;
}
if (js_Emit1(cx, cg, JSOP_NOP) < 0)
return false;
@ -6583,18 +6588,17 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
}
if (js_Emit1(cx, cg, op) < 0)
return JS_FALSE;
if (js_CodeSpec[op].format & JOF_DECOMPOSE) {
/*
* This is dead code for the decompiler, don't generate
* a decomposed version of the opcode. We do need to balance
* the stacks in the decomposed version.
*/
JS_ASSERT(js_CodeSpec[op].format & JOF_DECOMPOSE);
JS_ASSERT(js_CodeSpec[op].format & JOF_ELEM);
if (js_Emit1(cx, cg, (JSOp)1) < 0)
return JS_FALSE;
if (js_Emit1(cx, cg, JSOP_POP) < 0)
return JS_FALSE;
}
break;
#if JS_HAS_XML_SUPPORT
case TOK_UNARYOP:
@ -6603,7 +6607,7 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
return JS_FALSE;
if (js_Emit1(cx, cg, JSOP_BINDXMLNAME) < 0)
return JS_FALSE;
if (js_Emit1(cx, cg, op) < 0)
if (!EmitElemIncDec(cx, NULL, op, cg))
return JS_FALSE;
break;
#endif