fixing JSScript size static asserts

RESOLVED FIXED

Status

()

RESOLVED FIXED
8 years ago
8 years ago

People

(Reporter: igor, Assigned: igor)

Tracking

Trunk
x86_64
Linux
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment, 1 obsolete attachment)

(Assignee)

Description

8 years ago
Created attachment 508254 [details] [diff] [review]
updated assert

Currently JSScript uses 8-bit offsets to access optional arrays of objects, regexps etc. But on a 64 bit CPU if all arrays are present then in a debug build the offset for JSConstArray array exceeds 255. This was not detected previously since the static assert that was supposed to check that was not updated to include the new arrays that was added to JSScript.

The attached patch fixes the assert and with it SM no longer builds.
(Assignee)

Comment 1

8 years ago
The bug in its initial form is invalid since the code nowdays uses (this + 1) + offset to get into the array. Thus the size of the script does not matter, we just need to update the static assert to check that the sum of all array sizes is less then JSScript::INVALID_OFFSET.
Summary: JSScript should be trimmed or use 16 bit offsets for optional arrays → fixing JSScript size static asserts
(Assignee)

Comment 2

8 years ago
Created attachment 508258 [details] [diff] [review]
updated assert
Assignee: general → igor
Attachment #508254 - Attachment is obsolete: true
Attachment #508258 - Flags: review?
(Assignee)

Updated

8 years ago
Attachment #508258 - Flags: review? → review?(dmandelin)
Attachment #508258 - Flags: review?(dmandelin) → review+
(Assignee)

Comment 3

8 years ago
http://hg.mozilla.org/tracemonkey/rev/df86b2068da5
Whiteboard: fixed-in-tracemonkey
Status: NEW → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.