wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-11-01 12:07:34 +09:00
Code Issues Projects Releases Packages Wiki Activity

Convert CopyBoxedOrUnboxedDenseElements to something that doesn't crash.

Browse source
This commit is contained in:
wolfbeast 2019-06-17 18:37:23 +00:00 • committed by Roy Tam
commit ec0e78d127
3 changed files with 33 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

18
js/src/vm/UnboxedObject-inl.h
View file

@ -226,24 +226,6 @@ MoveBoxedOrUnboxedDenseElements(JSContext* cx, JSObject* obj, uint32_t dstStart,
return DenseElementResult::Success;
}
static inline DenseElementResult
CopyBoxedOrUnboxedDenseElements(JSContext* cx, JSObject* dst, JSObject* src,
uint32_t dstStart, uint32_t srcStart, uint32_t length)
{
MOZ_ASSERT(src->isNative());
MOZ_ASSERT(dst->isNative());
MOZ_ASSERT(dst->as<NativeObject>().getDenseInitializedLength() == dstStart);
MOZ_ASSERT(src->as<NativeObject>().getDenseInitializedLength() >= srcStart + length);
MOZ_ASSERT(dst->as<NativeObject>().getDenseCapacity() >= dstStart + length);
dst->as<NativeObject>().setDenseInitializedLength(dstStart + length);
const Value* vp = src->as<NativeObject>().getDenseElements() + srcStart;
dst->as<NativeObject>().initDenseElements(dstStart, vp, length);
return DenseElementResult::Success;
}
} // namespace js
#endif // vm_UnboxedObject_inl_h