mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
Bug 924864 - Make sure GenerateSetDenseElement calls post barrier on array length increase r=terrence
This commit is contained in:
parent
5360e7e16d
commit
825723bb37
@ -3499,7 +3499,7 @@ GenerateSetDenseElement(JSContext *cx, MacroAssembler &masm, IonCache::StubAttac
|
|||||||
masm.branch32(Assembler::Below, initLength, index, &outOfBounds);
|
masm.branch32(Assembler::Below, initLength, index, &outOfBounds);
|
||||||
|
|
||||||
// if (initLength == index)
|
// if (initLength == index)
|
||||||
Label markElem, storeElem;
|
Label markElem, postBarrier;
|
||||||
masm.branch32(Assembler::NotEqual, initLength, index, &markElem);
|
masm.branch32(Assembler::NotEqual, initLength, index, &markElem);
|
||||||
{
|
{
|
||||||
// Increase initialize length.
|
// Increase initialize length.
|
||||||
@ -3516,7 +3516,7 @@ GenerateSetDenseElement(JSContext *cx, MacroAssembler &masm, IonCache::StubAttac
|
|||||||
|
|
||||||
// Restore the index.
|
// Restore the index.
|
||||||
masm.bumpKey(&newLength, -1);
|
masm.bumpKey(&newLength, -1);
|
||||||
masm.jump(&storeElem);
|
masm.jump(&postBarrier);
|
||||||
}
|
}
|
||||||
// else
|
// else
|
||||||
{
|
{
|
||||||
@ -3527,12 +3527,12 @@ GenerateSetDenseElement(JSContext *cx, MacroAssembler &masm, IonCache::StubAttac
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Call post barrier if necessary, and recalculate elements pointer if it got cobbered.
|
// Call post barrier if necessary, and recalculate elements pointer if it got cobbered.
|
||||||
|
masm.bind(&postBarrier);
|
||||||
Register postBarrierScratch = elements;
|
Register postBarrierScratch = elements;
|
||||||
if (masm.maybeCallPostBarrier(object, value, postBarrierScratch))
|
if (masm.maybeCallPostBarrier(object, value, postBarrierScratch))
|
||||||
masm.loadPtr(Address(object, JSObject::offsetOfElements()), elements);
|
masm.loadPtr(Address(object, JSObject::offsetOfElements()), elements);
|
||||||
|
|
||||||
// Store the value.
|
// Store the value.
|
||||||
masm.bind(&storeElem);
|
|
||||||
masm.storeConstantOrRegister(value, target);
|
masm.storeConstantOrRegister(value, target);
|
||||||
}
|
}
|
||||||
attacher.jumpRejoin(masm);
|
attacher.jumpRejoin(masm);
|
||||||
|
Loading…
Reference in New Issue
Block a user