mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
Bug 798913 - Prevent inlining of overflow of arguments. r=dvander
This commit is contained in:
parent
400b984ab4
commit
360c00abc4
@ -2885,7 +2885,7 @@ IonBuilder::jsop_call_inline(HandleFunction callee, uint32 argc, bool constructi
|
||||
}
|
||||
|
||||
bool
|
||||
IonBuilder::makeInliningDecision(AutoObjectVector &targets)
|
||||
IonBuilder::makeInliningDecision(AutoObjectVector &targets, uint32 argc)
|
||||
{
|
||||
if (inliningDepth >= js_IonOptions.maxInlineDepth)
|
||||
return false;
|
||||
@ -2913,6 +2913,12 @@ IonBuilder::makeInliningDecision(AutoObjectVector &targets)
|
||||
|
||||
JSScript *script = target->script();
|
||||
uint32_t calleeUses = script->getUseCount();
|
||||
|
||||
if (target->nargs < argc) {
|
||||
IonSpew(IonSpew_Inlining, "Not inlining, overflow of arguments.");
|
||||
return false;
|
||||
}
|
||||
|
||||
totalSize += script->length;
|
||||
if (totalSize > js_IonOptions.inlineMaxTotalBytecodeLength)
|
||||
return false;
|
||||
@ -3710,7 +3716,7 @@ IonBuilder::jsop_call(uint32 argc, bool constructing)
|
||||
}
|
||||
}
|
||||
|
||||
if (numTargets > 0 && makeInliningDecision(targets))
|
||||
if (numTargets > 0 && makeInliningDecision(targets, argc))
|
||||
return inlineScriptedCall(targets, argc, constructing, types, barrier);
|
||||
}
|
||||
|
||||
|
@ -399,7 +399,7 @@ class IonBuilder : public MIRGenerator
|
||||
Vector<MDefinition *, 8, IonAllocPolicy> &retvalDefns);
|
||||
bool inlineScriptedCall(AutoObjectVector &targets, uint32 argc, bool constructing,
|
||||
types::StackTypeSet *types, types::StackTypeSet *barrier);
|
||||
bool makeInliningDecision(AutoObjectVector &targets);
|
||||
bool makeInliningDecision(AutoObjectVector &targets, uint32 argc);
|
||||
|
||||
MCall *makeCallHelper(HandleFunction target, uint32 argc, bool constructing);
|
||||
bool makeCallBarrier(HandleFunction target, uint32 argc, bool constructing,
|
||||
|
Loading…
Reference in New Issue
Block a user