From 421fd434f35a0e2be7645abca15807a29d9c567e Mon Sep 17 00:00:00 2001 From: Pale Moon Date: Tue, 21 Nov 2017 19:44:25 +0100 Subject: [PATCH] Use ARGS_LENGTH_MAX as upper bound in MArgumentsLength::computeRange. --- js/src/jit/RangeAnalysis.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/js/src/jit/RangeAnalysis.cpp b/js/src/jit/RangeAnalysis.cpp index 625dad31c5..76778fa627 100644 --- a/js/src/jit/RangeAnalysis.cpp +++ b/js/src/jit/RangeAnalysis.cpp @@ -15,6 +15,7 @@ #include "jit/MIRGenerator.h" #include "jit/MIRGraph.h" #include "js/Conversions.h" +#include "vm/ArgumentsObject.h" #include "vm/TypedArrayCommon.h" #include "jsopcodeinlines.h" @@ -1717,9 +1718,9 @@ MArgumentsLength::computeRange(TempAllocator& alloc) { // This is is a conservative upper bound on what |TooManyActualArguments| // checks. If exceeded, Ion will not be entered in the first place. - MOZ_ASSERT(js_JitOptions.maxStackArgs <= UINT32_MAX, - "NewUInt32Range requires a uint32 value"); - setRange(Range::NewUInt32Range(alloc, 0, js_JitOptions.maxStackArgs)); + static_assert(ARGS_LENGTH_MAX <= UINT32_MAX, + "NewUInt32Range requires a uint32 value"); + setRange(Range::NewUInt32Range(alloc, 0, ARGS_LENGTH_MAX)); } void