wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Fix crash in object-wrapped string length IC (bug 623474, r=dvander).

Browse Source
This commit is contained in:
Tom Schuster 2011-01-07 14:30:10 -08:00
parent 9e176a411b
commit acbe1325b9
2 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
js/src/jit-test/tests/jaeger/bug623474.js Normal file
View File

@ -0,0 +1,10 @@
for (var j=0;j<2;++j) { (function(o){o.length})(String.prototype); }
for each(let y in [Number, Number]) {
try {
"".length()
} catch(e) {}
}
/* Don't crash. */

5
js/src/methodjit/PolyIC.cpp
View File

@ -905,8 +905,9 @@ class GetPropCompiler : public PICStubCompiler
Assembler masm;
Jump notStringObj = masm.testObjClass(Assembler::NotEqual, pic.objReg, obj->getClass());
masm.loadPayload(Address(pic.objReg, JSObject::getFixedSlotOffset(
JSObject::JSSLOT_PRIMITIVE_THIS)), pic.objReg);
masm.loadPtr(Address(pic.objReg, offsetof(JSObject, slots)), pic.objReg);
masm.loadPayload(Address(pic.objReg, JSObject::JSSLOT_PRIMITIVE_THIS * sizeof(Value)),
pic.objReg);
masm.loadPtr(Address(pic.objReg, JSString::offsetOfLengthAndFlags()), pic.objReg);
masm.urshift32(Imm32(JSString::LENGTH_SHIFT), pic.objReg);
masm.move(ImmType(JSVAL_TYPE_INT32), pic.shapeReg);