wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 893732 - Ensure indexes are integers when loading/storing to static typed arrays, r=jandem.

Browse Source
This commit is contained in:
Brian Hackett 2013-07-18 13:33:44 -06:00
parent 17a39c5cdb
commit 992fab173b
3 changed files with 26 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
js/src/ion/MIR.h
View File

@ -5042,7 +5042,9 @@ class MLoadTypedArrayElementHole
};
// Load a value fallibly or infallibly from a statically known typed array.
class MLoadTypedArrayElementStatic : public MUnaryInstruction
class MLoadTypedArrayElementStatic
: public MUnaryInstruction,
public IntPolicy<0>
{
MLoadTypedArrayElementStatic(TypedArrayObject *typedArray, MDefinition *ptr)
: MUnaryInstruction(ptr), typedArray_(typedArray), fallible_(true)
@ -5081,6 +5083,10 @@ class MLoadTypedArrayElementStatic : public MUnaryInstruction
fallible_ = false;
}
TypePolicy *typePolicy() {
return this;
}
void computeRange();
bool truncate();
};

7
js/src/ion/TypePolicy.cpp
View File

@ -324,6 +324,9 @@ IntPolicy<Op>::staticAdjustInputs(MInstruction *def)
if (in->type() == MIRType_Int32)
return true;
if (in->type() != MIRType_Value)
in = boxAt(def, in);
MUnbox *replace = MUnbox::New(in, MIRType_Int32, MUnbox::Fallible);
def->block()->insertBefore(def, replace);
def->replaceOperand(Op, replace);
@ -562,9 +565,9 @@ bool
StoreTypedArrayElementStaticPolicy::adjustInputs(MInstruction *ins)
{
MStoreTypedArrayElementStatic *store = ins->toStoreTypedArrayElementStatic();
JS_ASSERT(store->ptr()->type() == MIRType_Int32);
return adjustValueInput(ins, store->viewType(), store->value(), 1);
return IntPolicy<0>::staticAdjustInputs(ins) &&
adjustValueInput(ins, store->viewType(), store->value(), 1);
}
bool

14
js/src/jit-test/tests/ion/bug893732.js Normal file
View File

@ -0,0 +1,14 @@
var arr = new Int8Array(100);
function f(a) {
for(var i=0; i<30; i++) {
x = a[85.3];
}
}
f(arr);
var buf = serialize(new Date(NaN));
var n = -(8.64e15 + 1);
var nbuf = serialize(n);
for (var j = 0; j < 8; j++)
buf[j + (0.00000000123)] = nbuf[j];