diff --git a/js/src/builtin/TypedObject.js b/js/src/builtin/TypedObject.js index a5f4a39d9a3e..0040d4e9bdeb 100644 --- a/js/src/builtin/TypedObject.js +++ b/js/src/builtin/TypedObject.js @@ -303,7 +303,8 @@ TypedObjectPointer.prototype.moveToFieldIndex = function(index) { "bad field descr"); assert(TO_INT32(fieldOffset) === fieldOffset, "bad field offset"); - assert(fieldOffset >= 0 && fieldOffset < DESCR_SIZE(this.descr), + assert(fieldOffset >= 0 && + (fieldOffset + DESCR_SIZE(fieldDescr)) <= DESCR_SIZE(this.descr), "out of bounds field offset"); this.descr = fieldDescr; diff --git a/js/src/jit-test/tests/TypedObject/bug973563.js b/js/src/jit-test/tests/TypedObject/bug973563.js new file mode 100644 index 000000000000..2112cc023ffb --- /dev/null +++ b/js/src/jit-test/tests/TypedObject/bug973563.js @@ -0,0 +1,9 @@ +// Test that empty sized structs don't trigger any assertion failures. +// Public domain. + +if (!this.hasOwnProperty("TypedObject")) + quit(); + +var PointType = new TypedObject.StructType({}); +var LineType = new TypedObject.StructType({source: PointType, target: PointType}); +var fromAToB = new LineType({source: {x: 22, y: 44}, target: {x: 66, y: 88}});