Bug 595916 - don't access actual args in TraceRecorder (r=dvander)

--HG--
extra : rebase_source : 72db63003c6995b446a5718fae1ca101e3a23996
This commit is contained in:
Luke Wagner 2010-09-15 21:55:02 -07:00
parent 204b2a98e5
commit 4399739182
2 changed files with 19 additions and 7 deletions

View File

@ -10076,17 +10076,19 @@ TraceRecorder::clearCurrentFrameSlotsFromTracker(Tracker& which)
return;
}
/* For simplicitly, flush 'em all, even non-canonical arg slots. */
Value *vp = fp->actualArgs() - 2 /* callee, this */;
Value *vpend = fp->formalArgsEnd();
for (; vp < vpend; ++vp)
which.set(vp, (LIns*)0);
if (!fp->isEvalFrame()) {
/* For simplicitly, flush 'em all, even non-canonical arg slots. */
Value *vp = fp->actualArgs() - 2 /* callee, this */;
Value *vpend = fp->formalArgsEnd();
for (; vp < vpend; ++vp)
which.set(vp, (LIns*)0);
}
which.set(fp->addressOfArgs(), (LIns*)0);
which.set(fp->addressOfScopeChain(), (LIns*)0);
vp = fp->slots();
vpend = fp->slots() + fp->functionScript()->nslots;
Value *vp = fp->slots();
Value *vpend = fp->slots() + fp->functionScript()->nslots;
for (; vp < vpend; ++vp)
which.set(vp, (LIns*)0);
}

View File

@ -0,0 +1,10 @@
(function () {
try {
eval("\
for each(let d in[0,0,0,0,0,0,0,0]) {\
for(let b in[0,0]) {}\
}\
")
} catch (e) {}
})()