Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix stack budget for postfix ++ and -- applied to property refs (350238, r=mrbkap).

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@209318 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
brendan%mozilla.org
2006-09-07 04:47:23 +00:00
parent 4c4ed66ace
commit 6c9dc525de
1 changed files with 16 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
mozilla/js/src/jsemit.c
View File

@@ -5336,6 +5336,20 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
pn2 = pn->pn_kid;
JS_ASSERT(pn2->pn_type != TOK_RP);
op = pn->pn_op;
/*
* Allocate another stack slot for GC protection in case the initial
* value being post-incremented or -decremented is not a number, but
* converts to a jsdouble. In the TOK_NAME cases, op has 0 operand
* uses and 1 definition, so we don't need an extra stack slot -- we
* can use the one allocated for the def.
*/
if (pn2->pn_type != TOK_NAME &&
(js_CodeSpec[op].format & JOF_POST) &&
(uintN)++cg->stackDepth > cg->maxStackDepth) {
cg->maxStackDepth = cg->stackDepth;
}
switch (pn2->pn_type) {
case TOK_NAME:
pn2->pn_op = op;
@@ -5391,18 +5405,8 @@ js_EmitTree(JSContext *cx, JSCodeGenerator *cg, JSParseNode *pn)
JS_ASSERT(0);
}
/*
* Allocate another stack slot for GC protection in case the initial
* value being post-incremented or -decremented is not a number, but
* converts to a jsdouble. In the TOK_NAME cases, op has 0 operand
* uses and 1 definition, so we don't need an extra stack slot -- we
* can use the one allocated for the def.
*/
if (pn2->pn_type != TOK_NAME &&
(js_CodeSpec[op].format & JOF_POST) &&
(uintN)cg->stackDepth == cg->maxStackDepth) {
++cg->maxStackDepth;
}
if (pn2->pn_type != TOK_NAME && (js_CodeSpec[op].format & JOF_POST))
--cg->stackDepth;
break;
case TOK_DELETE: