зеркало из https://github.com/mozilla/gecko-dev.git
Reland Bug 582479 - TM: Assertion failure: (&cx->regs->sp[1 - (iargc + 2)].toObject())->isFunction().
This commit is contained in:
Родитель
f044458468
Коммит
939e685ea8
|
@ -14905,14 +14905,18 @@ TraceRecorder::record_JSOP_LAMBDA()
|
|||
* so regs.sp[1 - (iargc + 2)], and not regs.sp[-(iargc + 2)],
|
||||
* is the callee for this JSOP_CALL.
|
||||
*/
|
||||
JSFunction *calleeFun =
|
||||
GET_FUNCTION_PRIVATE(cx, &cx->regs->sp[1 - (iargc + 2)].toObject());
|
||||
FastNative fastNative = FUN_FAST_NATIVE(calleeFun);
|
||||
const Value &cref = cx->regs->sp[1 - (iargc + 2)];
|
||||
JSObject *callee;
|
||||
|
||||
if ((iargc == 1 && fastNative == array_sort) ||
|
||||
(iargc == 2 && fastNative == str_replace)) {
|
||||
stack(0, INS_CONSTOBJ(FUN_OBJECT(fun)));
|
||||
return ARECORD_CONTINUE;
|
||||
if (IsFunctionObject(cref, &callee)) {
|
||||
JSFunction *calleeFun = GET_FUNCTION_PRIVATE(cx, callee);
|
||||
FastNative fastNative = FUN_FAST_NATIVE(calleeFun);
|
||||
|
||||
if ((iargc == 1 && fastNative == array_sort) ||
|
||||
(iargc == 2 && fastNative == str_replace)) {
|
||||
stack(0, INS_CONSTOBJ(FUN_OBJECT(fun)));
|
||||
return ARECORD_CONTINUE;
|
||||
}
|
||||
}
|
||||
} else if (op2 == JSOP_NULL) {
|
||||
pc2 += JSOP_NULL_LENGTH;
|
||||
|
|
Загрузка…
Ссылка в новой задаче