mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
Bug 844364 - Fix bogus assertion, inverted test when compiling JSOP_EVAL, r=jandem.
This commit is contained in:
parent
0c513c127d
commit
59348db6ca
@ -4488,15 +4488,14 @@ IonBuilder::jsop_eval(uint32_t argc)
|
|||||||
return abort("Direct eval in global code");
|
return abort("Direct eval in global code");
|
||||||
|
|
||||||
types::StackTypeSet *thisTypes = oracle->thisTypeSet(script());
|
types::StackTypeSet *thisTypes = oracle->thisTypeSet(script());
|
||||||
if (!thisTypes) {
|
|
||||||
// The 'this' value for the outer and eval scripts must be the
|
// The 'this' value for the outer and eval scripts must be the
|
||||||
// same. This is not guaranteed if a primitive string/number/etc.
|
// same. This is not guaranteed if a primitive string/number/etc.
|
||||||
// is passed through to the eval invoke as the primitive may be
|
// is passed through to the eval invoke as the primitive may be
|
||||||
// boxed into different objects if accessed via 'this'.
|
// boxed into different objects if accessed via 'this'.
|
||||||
JSValueType type = thisTypes->getKnownTypeTag();
|
JSValueType type = thisTypes->getKnownTypeTag();
|
||||||
if (type != JSVAL_TYPE_OBJECT && type != JSVAL_TYPE_NULL && type != JSVAL_TYPE_UNDEFINED)
|
if (type != JSVAL_TYPE_OBJECT && type != JSVAL_TYPE_NULL && type != JSVAL_TYPE_UNDEFINED)
|
||||||
return abort("Direct eval from script with maybe-primitive 'this'");
|
return abort("Direct eval from script with maybe-primitive 'this'");
|
||||||
}
|
|
||||||
|
|
||||||
CallInfo callInfo(cx, /* constructing = */ false);
|
CallInfo callInfo(cx, /* constructing = */ false);
|
||||||
if (!callInfo.init(current, argc))
|
if (!callInfo.init(current, argc))
|
||||||
|
6
js/src/jit-test/tests/ion/bug844364.js
Normal file
6
js/src/jit-test/tests/ion/bug844364.js
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
|
||||||
|
function f() {
|
||||||
|
eval("this")
|
||||||
|
}
|
||||||
|
f()
|
||||||
|
f()
|
7
js/src/jit-test/tests/ion/bug844459.js
Normal file
7
js/src/jit-test/tests/ion/bug844459.js
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
|
||||||
|
|
||||||
|
function testEvalThrow(x, y) {
|
||||||
|
eval("");
|
||||||
|
}
|
||||||
|
for (var i = 0; i < 5; i++)
|
||||||
|
testEvalThrow.call("");
|
@ -97,9 +97,11 @@ ComputeThis(JSContext *cx, AbstractFramePtr frame)
|
|||||||
* |this| slot. If we lazily wrap a primitive |this| in an eval function frame, the
|
* |this| slot. If we lazily wrap a primitive |this| in an eval function frame, the
|
||||||
* eval's frame will get the wrapper, but the function's frame will not. To prevent
|
* eval's frame will get the wrapper, but the function's frame will not. To prevent
|
||||||
* this, we always wrap a function's |this| before pushing an eval frame, and should
|
* this, we always wrap a function's |this| before pushing an eval frame, and should
|
||||||
* thus never see an unwrapped primitive in a non-strict eval function frame.
|
* thus never see an unwrapped primitive in a non-strict eval function frame. Null
|
||||||
|
* and undefined |this| values will unwrap to the same object in the function and
|
||||||
|
* eval frames, so are not required to be wrapped.
|
||||||
*/
|
*/
|
||||||
JS_ASSERT(!frame.isEvalFrame());
|
JS_ASSERT_IF(frame.isEvalFrame(), thisv.isUndefined() || thisv.isNull());
|
||||||
}
|
}
|
||||||
bool modified;
|
bool modified;
|
||||||
if (!BoxNonStrictThis(cx, &thisv, &modified))
|
if (!BoxNonStrictThis(cx, &thisv, &modified))
|
||||||
|
Loading…
Reference in New Issue
Block a user