wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 866611 - Fix length check when inlining string concatenation. r=h4writer

Browse Source
This commit is contained in:
Jan de Mooij 2013-04-29 19:22:50 +02:00
parent 432f850d5a
commit 6cb2d2291b
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
js/src/ion/CodeGenerator.cpp
View File

@ -3670,7 +3670,7 @@ IonCompartment::generateStringConcatStub(JSContext *cx)
&isShort);
// Ensure result length <= JSString::MAX_LENGTH.
masm.branch32(Assembler::Above, temp1, Imm32(JSString::MAX_LENGTH), &failure);
masm.branch32(Assembler::Above, temp2, Imm32(JSString::MAX_LENGTH), &failure);
// Allocate a new rope.
masm.newGCString(output, &failure);

5
js/src/jit-test/tests/ion/bug866611.js Normal file
View File

@ -0,0 +1,5 @@
// |jit-test| error: InternalError
y = 'x'
for (var i=0; i<100; i++)
y += y;
print(y.length);