959932 - Fix some unsafe address issues in js/src/vm

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Boris Zbarsky [:bzbarsky]]

This does not fix the StackShape bits in GlobalObject or Shape, or the PropDesc stuff in ObjectImpl, because I'm not sure what the right fixes are there.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix some unsafe address issues in js/src/vm.

Comment 2

[Steve Fink [:sfink] [:s:]]

Comment on attachment 8360202 [details] [diff] [review]
Fix some unsafe address issues in js/src/vm.

Review of attachment 8360202 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/vm/Interpreter.cpp
@@ +84,5 @@
>  #endif
>  LooseEqualityOp(JSContext *cx, FrameRegs &regs)
>  {
> +    HandleValue rval = HandleValue::fromMarkedLocation(&regs.sp[-1]);
> +    HandleValue lval = HandleValue::fromMarkedLocation(&regs.sp[-2]);

regs.stackHandleAt(-1) and (-2), please.

Comment 3

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1860fe32a32e with that change; thanks for pointing out the sane API!

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/1860fe32a32e