wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-08 00:38:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

Security fixes toward 105 version.

Browse source 
Security fixes toward 105 version.
This commit is contained in:
win7-7 2022-10-13 23:52:00 +03:00 • committed by wuggy
commit 50813a86e5
2 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
js/src/jit/IonBuilder.cpp
View file

@ -3717,6 +3717,8 @@ IonBuilder::replaceTypeSet(MDefinition* subject, TemporaryTypeSet* type, MTest*
if (type->unknown())
return true;
MOZ_ASSERT(!type->hasType(TypeSet::MagicArgType()));
// Don't emit MFilterTypeSet if it doesn't improve the typeset.
if (subject->resultTypeSet()) {
if (subject->resultTypeSet()->equals(type))

5
js/src/jit/MIR.h
View file

@ -3756,9 +3756,10 @@ class MCreateThisWithTemplate
return initialHeap_;
}
// Although creation of |this| modifies global state, it is safely repeatable.
// Performs a property read from |newTarget| if |newTarget| is a JSFunction
// with an own |.prototype| property.
AliasSet getAliasSet() const override {
return AliasSet::None();
return AliasSet::Load(AliasSet::Any);
}
MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override;