firefox/CVE-2021-29984.patch
2024-07-16 09:44:16 +08:00

29 lines
955 B
Diff

From aacfe50a8236d826f9ac615a3a2611fd1487997d Mon Sep 17 00:00:00 2001
From: Jan de Mooij <jdemooij@mozilla.com>
Date: Mon, 15 Jul 2024 16:46:36 +0800
Subject: [PATCH] Bug 1720031 - Check for SetInitializedLength when reordering. r=iain
Reference:https://hg.mozilla.org/integration/autoland/rev/7528462f1eef91beaf5a97c78c44b3c35b7f5cd1
---
js/src/jit/InstructionReordering.cpp | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/js/src/jit/InstructionReordering.cpp b/js/src/jit/InstructionReordering.cpp
index 191fcb2..224bf0f 100644
--- a/js/src/jit/InstructionReordering.cpp
+++ b/js/src/jit/InstructionReordering.cpp
@@ -141,6 +141,10 @@ bool jit::ReorderInstructions(MIRGraph& graph) {
if (prev->isInterruptCheck()) {
break;
}
+ if (prev->isSetInitializedLength()) {
+ break;
+ }
+
// The instruction can't be moved before any of its uses.
bool isUse = false;
--
2.27.0