Fixed tracing some arguments usage on trace (bug 558618, r=gal). a1.9.2.6=LegNeato
authorDavid Anderson <danderson@mozilla.com>
Wed, 21 Apr 2010 01:10:23 -0700
changeset 34386 e4bf0cdd829ef577472bb7be1c340eef31ff7775
parent 34385 f2a4c8e82d16b20f380e65e90f6b924ba846507d
child 34387 a478fe5144d54f6d1c5392c51c0da57b0d62b085
push id1431
push usereakhgari@mozilla.com
push dateFri, 25 Jun 2010 21:10:38 +0000
reviewersgal
bugs558618
milestone1.9.2.6pre
Fixed tracing some arguments usage on trace (bug 558618, r=gal). a1.9.2.6=LegNeato
js/src/jstracer.cpp
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -13170,20 +13170,19 @@ TraceRecorder::record_JSOP_NOP()
 }
 
 JS_REQUIRES_STACK JSRecordingStatus
 TraceRecorder::record_JSOP_ARGSUB()
 {
     JSStackFrame* fp = cx->fp;
     if (!(fp->fun->flags & JSFUN_HEAVYWEIGHT)) {
         uintN slot = GET_ARGNO(fp->regs->pc);
-        if (slot < fp->argc)
-            stack(0, get(&cx->fp->argv[slot]));
-        else
-            stack(0, INS_VOID());
+        if (slot >= fp->argc)
+            RETURN_STOP_A("can't trace out-of-range arguments");
+        stack(0, get(&cx->fp->argv[slot]));
         return JSRS_CONTINUE;
     }
     ABORT_TRACE("can't trace JSOP_ARGSUB hard case");
 }
 
 JS_REQUIRES_STACK LIns*
 TraceRecorder::guardArgsLengthNotAssigned(LIns* argsobj_ins)
 {