wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 924864 - Make sure GenerateSetDenseElement calls post barrier on array length increase r=terrence

Browse Source
This commit is contained in:
Jon Coppeard 2013-10-15 10:02:07 +01:00
parent 5360e7e16d
commit 825723bb37
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
js/src/jit/IonCaches.cpp
View File

@ -3499,7 +3499,7 @@ GenerateSetDenseElement(JSContext *cx, MacroAssembler &masm, IonCache::StubAttac
masm.branch32(Assembler::Below, initLength, index, &outOfBounds);
// if (initLength == index)
Label markElem, storeElem;
Label markElem, postBarrier;
masm.branch32(Assembler::NotEqual, initLength, index, &markElem);
{
// Increase initialize length.
@ -3516,7 +3516,7 @@ GenerateSetDenseElement(JSContext *cx, MacroAssembler &masm, IonCache::StubAttac
// Restore the index.
masm.bumpKey(&newLength, -1);
masm.jump(&storeElem);
masm.jump(&postBarrier);
}
// else
{
@ -3527,12 +3527,12 @@ GenerateSetDenseElement(JSContext *cx, MacroAssembler &masm, IonCache::StubAttac
}
// Call post barrier if necessary, and recalculate elements pointer if it got cobbered.
masm.bind(&postBarrier);
Register postBarrierScratch = elements;
if (masm.maybeCallPostBarrier(object, value, postBarrierScratch))
masm.loadPtr(Address(object, JSObject::offsetOfElements()), elements);
// Store the value.
masm.bind(&storeElem);
masm.storeConstantOrRegister(value, target);
}
attacher.jumpRejoin(masm);