diff --git a/js/src/jit-test/tests/basic/regress-bug720680.js b/js/src/jit-test/tests/basic/regress-bug720680.js new file mode 100644 index 00000000000..ebb794fb545 --- /dev/null +++ b/js/src/jit-test/tests/basic/regress-bug720680.js @@ -0,0 +1,15 @@ +// |jit-test| error: InternalError +version(0); +eval("\ +function TimeFromYear( y ) {}\ +addTestCase( -2208988800000 );\ +function addTestCase( t ) {\ + var start = TimeFromYear((addTestCase(addTestCase << t, 0)));\ + new TestCase( \ + SECTION,\ + '(new Date('+d+')).getUTCDay()',\ + WeekDay((d)),\ + (new Date(let ({ stop } = 'properties.length' )('/ab[c\\\n]/'))).getUTCDay() \ + );\ +}\ +"); diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp index 4c25af71ae6..43c6f08611d 100644 --- a/js/src/jsopcode.cpp +++ b/js/src/jsopcode.cpp @@ -855,8 +855,7 @@ Sprinter::put(const char *s, size_t len) s = stringAt(s - oldBase); /* this is where it lives now */ memmove(bp, s, len); } else { - JS_ASSERT(s < base || s >= base + size); - memcpy(bp, s, len); + js_memcpy(bp, s, len); } bp[len] = 0; @@ -2059,7 +2058,7 @@ DecompileDestructuringLHS(SprintStack *ss, jsbytecode *pc, jsbytecode *endpc, JS * the nb parameter. */ ptrdiff_t todo = ss->sprinter.getOffset(); - ss->sprinter.setOffset(todo + PAREN_SLOP); + ss->sprinter.reserve(PAREN_SLOP); pc = Decompile(ss, pc, -((intN)ss->top)); if (!pc) return NULL;