* gnu/packages/patches/icecat-CVE-2015-2722-pt1.patch, gnu/packages/patches/icecat-CVE-2015-2722-pt2.patch, gnu/packages/patches/icecat-CVE-2015-2724-pt1.patch, gnu/packages/patches/icecat-CVE-2015-2724-pt2.patch, gnu/packages/patches/icecat-CVE-2015-2724-pt3.patch, gnu/packages/patches/icecat-CVE-2015-2724-pt4.patch, gnu/packages/patches/icecat-CVE-2015-2728-pt1.patch, gnu/packages/patches/icecat-CVE-2015-2728-pt2.patch, gnu/packages/patches/icecat-CVE-2015-2733-pt1.patch, gnu/packages/patches/icecat-CVE-2015-2733-pt2.patch, gnu/packages/patches/icecat-CVE-2015-2735.patch, gnu/packages/patches/icecat-CVE-2015-2736.patch, gnu/packages/patches/icecat-CVE-2015-2738.patch, gnu/packages/patches/icecat-CVE-2015-2739.patch, gnu/packages/patches/icecat-CVE-2015-2740.patch, gnu/packages/patches/icecat-CVE-2015-2743.patch: New files. * gnu-system.am (dist_patch_DATA): Add them. * gnu/packages/gnuzilla.scm (icecat)[source]: Add patches.
66 lines
2.3 KiB
Diff
66 lines
2.3 KiB
Diff
From 96dc9518fab0929293a8fc388f6a4a64d05b0f6f Mon Sep 17 00:00:00 2001
|
|
From: Jan de Mooij <jdemooij@mozilla.com>
|
|
Date: Wed, 10 Jun 2015 18:01:09 +0200
|
|
Subject: [PATCH] Bug 1143679 - Make TryNoteIterIon behave more like
|
|
Baseline/interpreter iterators. r=shu, a=lizzard
|
|
|
|
--HG--
|
|
extra : transplant_source : W%D0%1FGe%29%2A%E2%BC%0C%09%3BH%92%2A%A0%5CO%FD%89
|
|
---
|
|
js/src/jit/IonFrames.cpp | 20 +++++++++++++++++---
|
|
1 file changed, 17 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/js/src/jit/IonFrames.cpp b/js/src/jit/IonFrames.cpp
|
|
index 51f4301..3e41c0a 100644
|
|
--- a/js/src/jit/IonFrames.cpp
|
|
+++ b/js/src/jit/IonFrames.cpp
|
|
@@ -356,14 +356,20 @@ JitFrameIterator::machineState() const
|
|
return machine;
|
|
}
|
|
|
|
+static uint32_t
|
|
+NumArgAndLocalSlots(const InlineFrameIterator& frame)
|
|
+{
|
|
+ JSScript* script = frame.script();
|
|
+ return CountArgSlots(script, frame.maybeCallee()) + script->nfixed();
|
|
+}
|
|
+
|
|
static void
|
|
-CloseLiveIterator(JSContext* cx, const InlineFrameIterator& frame, uint32_t localSlot)
|
|
+CloseLiveIterator(JSContext* cx, const InlineFrameIterator& frame, uint32_t stackSlot)
|
|
{
|
|
SnapshotIterator si = frame.snapshotIterator();
|
|
|
|
// Skip stack slots until we reach the iterator object.
|
|
- uint32_t base = CountArgSlots(frame.script(), frame.maybeCallee()) + frame.script()->nfixed();
|
|
- uint32_t skipSlots = base + localSlot - 1;
|
|
+ uint32_t skipSlots = NumArgAndLocalSlots(frame) + stackSlot - 1;
|
|
|
|
for (unsigned i = 0; i < skipSlots; i++)
|
|
si.skip();
|
|
@@ -407,6 +413,11 @@ HandleExceptionIon(JSContext* cx, const InlineFrameIterator& frame, ResumeFromEx
|
|
if (!script->hasTrynotes())
|
|
return;
|
|
|
|
+ uint32_t base = NumArgAndLocalSlots(frame);
|
|
+ SnapshotIterator si = frame.snapshotIterator();
|
|
+ JS_ASSERT(si.numAllocations() >= base);
|
|
+ const uint32_t stackDepth = si.numAllocations() - base;
|
|
+
|
|
JSTryNote* tn = script->trynotes()->vector;
|
|
JSTryNote* tnEnd = tn + script->trynotes()->length;
|
|
|
|
@@ -417,6 +428,9 @@ HandleExceptionIon(JSContext* cx, const InlineFrameIterator& frame, ResumeFromEx
|
|
if (pcOffset >= tn->start + tn->length)
|
|
continue;
|
|
|
|
+ if (tn->stackDepth > stackDepth)
|
|
+ continue;
|
|
+
|
|
switch (tn->kind) {
|
|
case JSTRY_ITER: {
|
|
JS_ASSERT(JSOp(*(script->main() + tn->start + tn->length)) == JSOP_ENDITER);
|
|
--
|
|
2.4.3
|
|
|