wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Don't use wrong result value in stubs::SetElem, bug 620643. r=dmandelin

Browse Source
This commit is contained in:
Brian Hackett 2010-12-22 13:11:55 -08:00
parent c8eee530e2
commit b21aead711
2 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
js/src/jit-test/tests/jaeger/bug620643.js Normal file
View File

@ -0,0 +1 @@
var a = new Int32Array(); +(a[0]={});

8
js/src/methodjit/StubCalls.cpp
View File

@ -559,7 +559,7 @@ stubs::SetElem(VMFrame &f)
Value &objval = regs.sp[-3];
Value &idval = regs.sp[-2];
Value retval = regs.sp[-1];
Value rval = regs.sp[-1];
JSObject *obj;
jsid id;
@ -582,19 +582,19 @@ stubs::SetElem(VMFrame &f)
if ((jsuint)i >= obj->getArrayLength())
obj->setArrayLength(i + 1);
}
obj->setDenseArrayElement(i, regs.sp[-1]);
obj->setDenseArrayElement(i, rval);
goto end_setelem;
}
}
} while (0);
if (!obj->setProperty(cx, id, &retval, strict))
if (!obj->setProperty(cx, id, &rval, strict))
THROW();
end_setelem:
/* :FIXME: Moving the assigned object into the lowest stack slot
* is a temporary hack. What we actually want is an implementation
* of popAfterSet() that allows popping more than one value;
* this logic can then be handled in Compiler.cpp. */
regs.sp[-3] = retval;
regs.sp[-3] = regs.sp[-1];
}
template void JS_FASTCALL stubs::SetElem<true>(VMFrame &f);