nagai/fune
3
0
Fork 0
forked from mirrors/gecko-dev
Code Pull requests Activity

Bug 1885489 - Part 13: Make RSubstr less dependent on the RSub implementation. r=iain

Browse source 
Differential Revision: https://phabricator.services.mozilla.com/D205817
This commit is contained in:
André Bargull 2024-04-03 07:47:11 +00:00
parent 67434a18b1
commit 6acc652ea5
1 changed files with 10 additions and 3 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

13
js/src/jit/Recover.cpp
View file

@ -6,6 +6,8 @@
#include "jit/Recover.h"
#include "mozilla/Casting.h"
#include "jsmath.h"
#include "builtin/Object.h"
@ -1955,9 +1957,14 @@ bool RSubstr::recover(JSContext* cx, SnapshotIterator& iter) const {
// or CallSubstringKernelResult.
int32_t begin = iter.readInt32();
// Int32 because |length| is computed from MSub(truncated),
// MStringTrimEndIndex, or CallSubstringKernelResult.
int32_t length = iter.readInt32();
// |length| is computed from MSub(truncated), MStringTrimEndIndex, or
// CallSubstringKernelResult. The current MSub inputs won't overflow, so when
// RSub recovers the MSub instruction, the input will be representable as an
// Int32. This is only true as long as RSub calls |js::SubOperation|, which in
// turn calls |JS::Value::setNumber|. We don't want to rely on this exact call
// sequence, so instead use |readNumber| here and then release-assert the
// number is exactly representable as an Int32.
int32_t length = mozilla::ReleaseAssertedCast<int32_t>(iter.readNumber());
JSString* result = SubstringKernel(cx, str, begin, length);
if (!result) {