Fix crash in object-wrapped string length IC (bug 623474, r=dvander).
authorTom Schuster <evilpies@gmail.com>
Fri, 07 Jan 2011 14:30:10 -0800
changeset 60248 423d37840edf794d81092bacd609fcbcc46705aa
parent 60247 d8586631c5f07e5a92c1406cd46bf2580a47ee70
child 60249 c55afda0470fd26369c20e89db3cbfb5ffd30ace
push id17896
push usercleary@mozilla.com
push dateSat, 08 Jan 2011 08:51:06 +0000
treeherdermozilla-central@df3c1150dd7a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdvander
bugs623474
milestone2.0b9pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Fix crash in object-wrapped string length IC (bug 623474, r=dvander).
js/src/jit-test/tests/jaeger/bug623474.js
js/src/methodjit/PolyIC.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/bug623474.js
@@ -0,0 +1,10 @@
+for (var j=0;j<2;++j) { (function(o){o.length})(String.prototype); }
+
+for each(let y in [Number, Number]) {
+    try {
+        "".length()
+    } catch(e) {}
+}
+
+/* Don't crash. */
+
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -900,18 +900,19 @@ class GetPropCompiler : public PICStubCo
         return Lookup_Cacheable;
     }
 
     LookupStatus generateStringObjLengthStub()
     {
         Assembler masm;
 
         Jump notStringObj = masm.testObjClass(Assembler::NotEqual, pic.objReg, obj->getClass());
-        masm.loadPayload(Address(pic.objReg, JSObject::getFixedSlotOffset(
-                         JSObject::JSSLOT_PRIMITIVE_THIS)), pic.objReg);
+        masm.loadPtr(Address(pic.objReg, offsetof(JSObject, slots)), pic.objReg);
+        masm.loadPayload(Address(pic.objReg, JSObject::JSSLOT_PRIMITIVE_THIS * sizeof(Value)),
+                         pic.objReg);
         masm.loadPtr(Address(pic.objReg, JSString::offsetOfLengthAndFlags()), pic.objReg);
         masm.urshift32(Imm32(JSString::LENGTH_SHIFT), pic.objReg);
         masm.move(ImmType(JSVAL_TYPE_INT32), pic.shapeReg);
         Jump done = masm.jump();
 
         PICLinker buffer(masm, pic);
         if (!buffer.init(cx))
             return error();