wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 922499 - Fix SetPropertyIC generic proxy stub mistakenly swallowing DOM proxies. (r=djvj)

Browse Source
This commit is contained in:
Eric Faust 2013-10-16 16:37:14 -07:00
parent 28de882717
commit bb873dd278
1 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
js/src/jit/IonCaches.cpp
View File

@ -1554,17 +1554,19 @@ GetPropertyIC::tryAttachProxy(JSContext *cx, IonScript *ion, HandleObject obj,
static void
GenerateProxyClassGuards(MacroAssembler &masm, Register object, Register scratchReg,
Label *failures, Label *success)
Label *failures)
{
Label success;
// Ensure that the incoming object has one of the magic class pointers, i.e,
// that it is one of an ObjectProxy, FunctionProxy, or OuterWindowProxy.
// This is equivalent to obj->is<ProxyObject>().
masm.branchTestObjClass(Assembler::Equal, object, scratchReg,
CallableProxyClassPtr, success);
CallableProxyClassPtr, &success);
masm.branchTestObjClass(Assembler::Equal, object, scratchReg,
UncallableProxyClassPtr, success);
UncallableProxyClassPtr, &success);
masm.branchTestObjClass(Assembler::NotEqual, object, scratchReg,
OuterWindowProxyClassPtr, failures);
masm.bind(&success);
}
bool
@ -1592,9 +1594,7 @@ GetPropertyIC::tryAttachGenericProxy(JSContext *cx, IonScript *ion, HandleObject
masm.setFramePushed(ion->frameSize());
Label proxySuccess;
GenerateProxyClassGuards(masm, object(), scratchReg, &failures, &proxySuccess);
masm.bind(&proxySuccess);
GenerateProxyClassGuards(masm, object(), scratchReg, &failures);
// Ensure that the incoming object is not a DOM proxy, so that we can get to
// the specialized stubs
@ -2179,12 +2179,12 @@ SetPropertyIC::attachGenericProxy(JSContext *cx, IonScript *ion, void *returnAdd
Register scratch = regSet.takeGeneral();
masm.push(scratch);
GenerateProxyClassGuards(masm, object(), scratch, &proxyFailures, &proxySuccess);
GenerateProxyClassGuards(masm, object(), scratch, &proxyFailures);
// Remove the DOM proxies. They'll take care of themselves so this stub doesn't
// catch too much.
masm.branchTestProxyHandlerFamily(Assembler::Equal, object(), scratch,
GetDOMProxyHandlerFamily(), &proxyFailures);
// catch too much. The failure case is actually Equal. Fall through to the failure code.
masm.branchTestProxyHandlerFamily(Assembler::NotEqual, object(), scratch,
GetDOMProxyHandlerFamily(), &proxySuccess);
masm.bind(&proxyFailures);
masm.pop(scratch);