wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 952810 - Ionmonkey ARM: Fix a corner case, out of bounds array reference, in isNextBranch. r=mjrosenb

Browse Source
This commit is contained in:
Douglas Crosher 2013-12-22 22:28:50 +11:00
parent 653ad3e608
commit 774e60a155
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
View File

@ -220,9 +220,10 @@ struct BufferSliceTail : public BufferSlice<SliceSize> {
isBranch[idx >> 3] |= 1 << (idx & 0x7);
}
bool isNextBranch() {
if (this->nodeSize == InstBaseSize)
unsigned int size = this->nodeSize;
if (size == InstBaseSize || size >= SliceSize)
return false;
int idx = this->nodeSize / InstBaseSize;
int idx = size / InstBaseSize;
return (isBranch[idx >> 3] >> (idx & 0x7)) & 1;
}
};