664667 - JSObject::slotsAndStructSize returns incorrect size

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Craig Topper]

?: has lower precendence than + and * which causes the return in the following code to calculate size incorrectly. The ?: should be in parentheses.

inline size_t
JSObject::slotsAndStructSize(uint32 nslots) const
{
   bool isFun = isFunction() && this == (JSObject*) getPrivate();

   int ndslots = hasSlotsArray() ? nslots : 0;
   int nfslots = isFun ? 0 : numFixedSlots();

   return sizeof(js::Value) * (ndslots + nfslots)
          + isFun ? sizeof(JSFunction) : sizeof(JSObject);
}

Comment 1

[Craig Topper]

Attachment: Fix operator precedence issue in JSObject::slotsAndStructSize

Comment 2

[Josh Matthews [:jdm]]

Comment on attachment 539737 [details] [diff] [review]
Fix operator precedence issue in JSObject::slotsAndStructSize

Playing spin the r? bottle here.

Comment 3

[David Mandelin [:dmandelin]]

http://hg.mozilla.org/tracemonkey/rev/01f0e75fce22

Comment 4

[Chris Leary [:cdleary] (not checking bugmail)]

cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/01f0e75fce22