The VP engineering broke JSOP_NAME! We have to check whether the slot is actually interned and otherwise abort.
authorAndreas Gal <gal@mozilla.com>
Fri, 25 Jul 2008 16:51:42 -0700
changeset 17829 ff036e43274007e1bad6e9d2634b08368f74c831
parent 17827 fd9cf3c556ee0d410dc934be71956a0d33271d2c
child 17830 72893c1ee4a4714172689fe781860d7b4f9ccc8c
push id1452
push usershaver@mozilla.com
push dateFri, 22 Aug 2008 00:08:22 +0000
treeherderautoland@d13bb0868596 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone1.9.1a1pre
The VP engineering broke JSOP_NAME! We have to check whether the slot is actually interned and otherwise abort.
js/src/jstracer.cpp
js/src/jstracer.h
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -2835,16 +2835,19 @@ bool TraceRecorder::record_JSOP_SETNAME(
     if (obj != cx->fp->scopeChain || obj != globalObj)
         return false;
 
     LIns* obj_ins = get(&l);
     uint32 slot;
     if (!test_property_cache_direct_slot(obj, obj_ins, slot))
         return false;
 
+    if (!tracker.has(&STOBJ_GET_SLOT(obj, slot)))
+        ABORT_TRACE("JSOP_NAME on non-interned global: save us, upvar!");
+
     LIns* r_ins = get(&r);
     set(&STOBJ_GET_SLOT(obj, slot), r_ins);
 
     if (cx->fp->regs->pc[JSOP_SETNAME_LENGTH] != JSOP_POP)
         stack(-2, r_ins);
     return true;
 }
 
--- a/js/src/jstracer.h
+++ b/js/src/jstracer.h
@@ -202,17 +202,17 @@ class TraceRecorder {
     void stobj_set_slot(nanojit::LIns* obj_ins, unsigned slot,
                         nanojit::LIns*& dslots_ins, nanojit::LIns* v_ins);
     nanojit::LIns* stobj_get_slot(nanojit::LIns* obj_ins, unsigned slot,
                                   nanojit::LIns*& dslots_ins);
     bool native_set(nanojit::LIns* obj_ins, JSScopeProperty* sprop,
                     nanojit::LIns*& dslots_ins, nanojit::LIns* v_ins);
     bool native_get(nanojit::LIns* obj_ins, nanojit::LIns* pobj_ins, JSScopeProperty* sprop,
                     nanojit::LIns*& dslots_ins, nanojit::LIns*& v_ins);
-
+    
     bool prop(JSObject* obj, nanojit::LIns* obj_ins, uint32& slot, nanojit::LIns*& v_ins);
     bool elem(jsval& l, jsval& r, jsval*& vp, nanojit::LIns*& v_ins, nanojit::LIns*& addr_ins);
 
     bool getProp(JSObject* obj, nanojit::LIns* obj_ins);
     bool getProp(jsval& v);
     bool getThis(nanojit::LIns*& this_ins);
     
     bool box_jsval(jsval v, nanojit::LIns*& v_ins);