Bug 785805 - Segmentation fault when calling %ThrowError for message with three arguments. r=tschneidereit
authorNorbert Lindenberg <mozilladev@lindenbergsoftware.com>
Tue, 28 Aug 2012 20:03:00 +0200
changeset 103754 67c5a4852b9f85cb48c40ed2bf8f279b927e0a6a
parent 103753 17b1db7b293fdfe59b4f2b558023129b5d804cf4
child 103755 cf396cb6d4af6f1110c4635f8e41db788d82931b
push id14150
push usertschneidereit@gmail.com
push dateWed, 29 Aug 2012 11:33:59 +0000
treeherdermozilla-inbound@67c5a4852b9f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerstschneidereit
bugs785805
milestone18.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 785805 - Segmentation fault when calling %ThrowError for message with three arguments. r=tschneidereit
js/src/vm/GlobalObject.cpp
--- a/js/src/vm/GlobalObject.cpp
+++ b/js/src/vm/GlobalObject.cpp
@@ -209,17 +209,17 @@ intrinsic_IsCallable(JSContext *cx, unsi
 static JSBool
 intrinsic_ThrowError(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     JS_ASSERT(args.length() >= 1);
     uint32_t errorNumber = args[0].toInt32();
 
     char *errorArgs[3] = {NULL, NULL, NULL};
-    for (unsigned i = 1; i < 3 && i < args.length(); i++) {
+    for (unsigned i = 1; i < 4 && i < args.length(); i++) {
         RootedValue val(cx, args[i]);
         if (val.isInt32() || val.isString()) {
             errorArgs[i - 1] = JS_EncodeString(cx, ToString(cx, val));
         } else {
             ptrdiff_t spIndex = cx->stack.spIndexOf(val.address());
             errorArgs[i - 1] = DecompileValueGenerator(cx, spIndex, val, NullPtr(), 1);
         }
     }