From c7a38e16878e4a5a9ed5b6357669695b9fc45b9a Mon Sep 17 00:00:00 2001 From: "brendan%mozilla.org" Date: Mon, 20 Nov 2006 19:30:41 +0000 Subject: [PATCH] Fix JSOP_SETSP (and an assertion in JSOP_LEAVEBLOCK*) to cope with empty destructuring (355832, r=mrbkap). git-svn-id: svn://10.0.0.236/trunk@215487 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/js/src/jsinterp.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/mozilla/js/src/jsinterp.c b/mozilla/js/src/jsinterp.c index 94362633ef4..4ff5f4f266a 100644 --- a/mozilla/js/src/jsinterp.c +++ b/mozilla/js/src/jsinterp.c @@ -5320,8 +5320,10 @@ interrupt: for (obj = fp->blockChain; obj; obj = OBJ_GET_PARENT(cx, obj)) { JS_ASSERT(OBJ_GET_CLASS(cx, obj) == &js_BlockClass); - if (OBJ_BLOCK_DEPTH(cx, obj) < i) + if (OBJ_BLOCK_DEPTH(cx, obj) + OBJ_BLOCK_COUNT(cx, obj) <= i) { + JS_ASSERT(OBJ_BLOCK_DEPTH(cx, obj) < i || OBJ_BLOCK_COUNT(cx, obj) == 0); break; + } } fp->blockChain = obj; @@ -5869,9 +5871,7 @@ interrupt: } sp -= GET_UINT16(pc); - JS_ASSERT(op == JSOP_LEAVEBLOCKEXPR - ? fp->spbase < sp && sp <= fp->spbase + depth - : fp->spbase <= sp && sp < fp->spbase + depth); + JS_ASSERT(fp->spbase <= sp && sp <= fp->spbase + depth); /* Store the result into the topmost stack slot. */ if (op == JSOP_LEAVEBLOCKEXPR)