Bug 476666 - TM: Crash reading near 0 @Detecting, regression due to bug 476238. r=gal.

This commit is contained in:
Jason Orendorff 2009-02-03 12:19:50 -06:00
parent df4d8addef
commit f8ca22b197
2 changed files with 15 additions and 19 deletions

View File

@ -4293,13 +4293,11 @@ js_Interpret(JSContext *cx)
LOAD_ATOM(i);
}
id = ATOM_TO_JSID(atom);
BEGIN_PC_HINT(regs.pc);
if (entry
? !js_GetPropertyHelper(cx, aobj, id, &rval, &entry)
: !OBJ_GET_PROPERTY(cx, obj, id, &rval)) {
goto error;
}
END_PC_HINT();
if (entry
? !js_GetPropertyHelper(cx, aobj, id, &rval, &entry)
: !OBJ_GET_PROPERTY(cx, obj, id, &rval)) {
goto error;
}
} while (0);
STORE_OPND(-1, rval);
@ -4403,21 +4401,17 @@ js_Interpret(JSContext *cx)
goto error;
} else
#endif
BEGIN_PC_HINT(regs.pc);
if (entry
? !js_GetPropertyHelper(cx, aobj, id, &rval, &entry)
: !OBJ_GET_PROPERTY(cx, obj, id, &rval)) {
goto error;
}
END_PC_HINT();
if (entry
? !js_GetPropertyHelper(cx, aobj, id, &rval, &entry)
: !OBJ_GET_PROPERTY(cx, obj, id, &rval)) {
goto error;
}
STORE_OPND(-1, OBJECT_TO_JSVAL(obj));
STORE_OPND(-2, rval);
} else {
JS_ASSERT(obj->map->ops->getProperty == js_GetProperty);
BEGIN_PC_HINT(regs.pc);
if (!js_GetPropertyHelper(cx, obj, id, &rval, &entry))
goto error;
END_PC_HINT();
if (!js_GetPropertyHelper(cx, obj, id, &rval, &entry))
goto error;
STORE_OPND(-1, lval);
STORE_OPND(-2, rval);
}

View File

@ -3904,7 +3904,7 @@ static jsbytecode*
js_GetCurrentBytecodePC(JSContext* cx)
{
jsbytecode *pc = cx->pcHint;
if (!pc) {
if (!pc || !JS_ON_TRACE(cx)) {
JSStackFrame* fp = js_GetTopStackFrame(cx);
if (fp && fp->regs) {
pc = fp->regs->pc;
@ -3912,6 +3912,8 @@ js_GetCurrentBytecodePC(JSContext* cx)
// JSOP_GETELEM imacro (bug 476559).
if (*pc == JSOP_CALL && fp->imacpc && *fp->imacpc == JSOP_GETELEM)
pc = fp->imacpc;
} else {
pc = NULL;
}
}
return pc;