From 19c4996881b2d5094bf2d38798d5fc29abd6bba3 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Fri, 11 Oct 2024 22:02:44 +0200
Subject: [PATCH] Issue #2645 - Fix type confusion for `ResumeKind`

It used a mix of uint8_t and uint16_t. Set it to uint16_t.
Also don't allow non-typeset to simplify stubs used in compound opcodes.
---
 js/src/vm/Interpreter.cpp   | 7 ++++++-
 js/src/vm/Opcodes.h         | 2 +-
 js/src/vm/TypeInference.cpp | 4 +---
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index ad52234a31..db5e01803b 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -1960,8 +1960,13 @@ CASE(JSOP_RETRVAL)
 
         /* Resume execution in the calling frame. */
         if (MOZ_LIKELY(interpReturnOK)) {
-            TypeScript::Monitor(cx, script, REGS.pc, REGS.sp[-1]);
+            
+            if (JSOp(*REGS.pc) == JSOP_RESUME) {
+                ADVANCE_AND_DISPATCH(JSOP_RESUME_LENGTH);
+            }
 
+            TypeScript::Monitor(cx, script, REGS.pc, REGS.sp[-1]);
+            MOZ_ASSERT(CodeSpec[*REGS.pc].length == JSOP_CALL_LENGTH);            
             ADVANCE_AND_DISPATCH(JSOP_CALL_LENGTH);
         }
 
diff --git a/js/src/vm/Opcodes.h b/js/src/vm/Opcodes.h
index ad140ff7bc..c5be5f6bef 100644
--- a/js/src/vm/Opcodes.h
+++ b/js/src/vm/Opcodes.h
@@ -2106,7 +2106,7 @@
      *   Operands: resume kind (GeneratorObject::ResumeKind)
      *   Stack: gen, val => rval
      */ \
-    macro(JSOP_RESUME,        205,"resume",      NULL,    3,  2,  1,  JOF_UINT8|JOF_INVOKE) \
+    macro(JSOP_RESUME,        205,"resume",      NULL,    2,  2,  1,  JOF_UINT16|JOF_INVOKE) \
     /*
      * Pops the top two values on the stack as 'obj' and 'v', pushes 'v' to
      * 'obj'.
diff --git a/js/src/vm/TypeInference.cpp b/js/src/vm/TypeInference.cpp
index a36926eb94..8ed6e885f8 100644
--- a/js/src/vm/TypeInference.cpp
+++ b/js/src/vm/TypeInference.cpp
@@ -3335,9 +3335,7 @@ js::TypeMonitorResult(JSContext* cx, JSScript* script, jsbytecode* pc, TypeSet::
 void
 js::TypeMonitorResult(JSContext* cx, JSScript* script, jsbytecode* pc, const js::Value& rval)
 {
-    /* Allow the non-TYPESET scenario to simplify stubs used in compound opcodes. */
-    if (!(CodeSpec[*pc].format & JOF_TYPESET))
-        return;
+    MOZ_ASSERT(CodeSpec[*pc].format & JOF_TYPESET);
 
     if (!script->hasBaselineScript())
         return;