corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1303710 - Don't Ion-compile scripts with too many typesets. r=bhackett

Browse Source
This commit is contained in:
Jan de Mooij
2016-10-04 12:07:30 +02:00
parent a86f24ce08
commit 3f52f9d79d
2 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
js/src/jit/Ion.cpp
View File

@@ -2361,6 +2361,13 @@ CheckScript(JSContext* cx, JSScript* script, bool osr)
return false; return false;
} }
if (script->nTypeSets() >= UINT16_MAX) {
// In this case multiple bytecode ops can share a single observed
// TypeSet (see bug 1303710).
TrackAndSpewIonAbort(cx, script, "too many typesets");
return false;
}
return true; return true;
} }

1
js/src/jit/IonBuilder.cpp
View File

@@ -165,6 +165,7 @@ IonBuilder::IonBuilder(JSContext* analysisContext, CompileCompartment* comp,
MOZ_ASSERT(script()->hasBaselineScript() == (info->analysisMode() != Analysis_ArgumentsUsage)); MOZ_ASSERT(script()->hasBaselineScript() == (info->analysisMode() != Analysis_ArgumentsUsage));
MOZ_ASSERT(!!analysisContext == (info->analysisMode() == Analysis_DefiniteProperties)); MOZ_ASSERT(!!analysisContext == (info->analysisMode() == Analysis_DefiniteProperties));
MOZ_ASSERT(script_->nTypeSets() < UINT16_MAX);
if (!info->isAnalysis()) if (!info->isAnalysis())
script()->baselineScript()->setIonCompiledOrInlined(); script()->baselineScript()->setIonCompiledOrInlined();