wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Holey single-element dense array has null dslots, requires nulld defense (453173).

Browse Source
This commit is contained in:
Brendan Eich 2008-09-01 13:59:30 -07:00
parent cda5a77a1b
commit b3042b928d
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
js/src/jstracer.cpp
View File

@ -4950,7 +4950,8 @@ TraceRecorder::record_JSOP_ENDINIT()
JSObject* obj = JSVAL_TO_OBJECT(v);
if (OBJ_IS_DENSE_ARRAY(cx, obj)) {
// Until we get JSOP_NEWARRAY working, we do our optimizing here...
if (obj->fslots[JSSLOT_ARRAY_LENGTH] == 1 && JSVAL_IS_STRING(obj->dslots[0])) {
if (obj->fslots[JSSLOT_ARRAY_LENGTH] == 1 &&
obj->dslots && JSVAL_IS_STRING(obj->dslots[0])) {
LIns* v_ins = get(&v);
JS_ASSERT(v_ins->isCall() && v_ins->fid() == F_FastNewArray);
LIns* args[] = { stack(1), callArgN(v_ins, 1), cx_ins };