Bug 916612 - Put back the baseline nslots check (r=djvj)

--HG--
extra : rebase_source : a0381609778964a2b55439368720412ff430bf55
This commit is contained in:
Luke Wagner 2014-01-16 11:02:03 -06:00
parent 128328702b
commit a3871deb2e
2 changed files with 8 additions and 4 deletions

View File

@ -247,10 +247,6 @@ jit::BaselineCompile(JSContext *cx, HandleScript script)
static MethodStatus
CanEnterBaselineJIT(JSContext *cx, HandleScript script, bool osr)
{
// Limit the locals on a given script so that stack check on baseline frames
// doesn't overflow a uint32_t value.
JS_ASSERT(script->nslots() <= UINT16_MAX);
JS_ASSERT(jit::IsBaselineEnabled(cx));
// Skip if the script has been disabled.
@ -260,6 +256,9 @@ CanEnterBaselineJIT(JSContext *cx, HandleScript script, bool osr)
if (script->length() > BaselineScript::MAX_JSSCRIPT_LENGTH)
return Method_CantCompile;
if (script->nslots() > BaselineScript::MAX_JSSCRIPT_SLOTS)
return Method_CantCompile;
if (!cx->compartment()->ensureJitCompartmentExists(cx))
return Method_Error;

View File

@ -100,6 +100,11 @@ struct BaselineScript
public:
static const uint32_t MAX_JSSCRIPT_LENGTH = 0x0fffffffu;
// Limit the locals on a given script so that stack check on baseline frames
// doesn't overflow a uint32_t value.
// (MAX_JSSCRIPT_SLOTS * sizeof(Value)) must fit within a uint32_t.
static const uint32_t MAX_JSSCRIPT_SLOTS = 0xffffu;
private:
// Code pointer containing the actual method.
HeapPtr<JitCode> method_;