forwarded 285404 https://bugzilla.mozilla.org/show_bug.cgi?id=270878
reassign 285404 mozilla
tags 285404 + patch
thanks

        Hi,

 #285404 is a Mozilla bug in the libmozjs library and the submitter,
 Juergen Kreileder, was kind enough to write a patch.

 Please consider the attached patch for the next Debian Mozilla package
 as it seems to break Galeon on ppc64 kernels.

   Thanks,

-- 
Loïc Minier <[EMAIL PROTECTED]>
"Neutral President: I have no strong feelings one way or the other."
--- mozilla/js/src/jsarena.h.orig       2005-01-19 14:28:45.342935093 +0100
+++ mozilla/js/src/jsarena.h    2005-01-19 14:09:39.517551239 +0100
@@ -120,12 +120,10 @@ struct JSArenaPool {
         JSArena *_a = (pool)->current;                                        \
         size_t _nb = JS_ARENA_ALIGN(pool, nb);                                \
         jsuword _p = _a->avail;                                               \
-        jsuword _q = _p + _nb;                                                \
-        JS_ASSERT(_q >= _p);                                                  \
-        if (_q > _a->limit)                                                   \
+        if (_p > _a->limit - _nb)                                             \
             _p = (jsuword)JS_ArenaAllocate(pool, _nb);                        \
         else                                                                  \
-            _a->avail = _q;                                                   \
+            _a->avail = _p + _nb;                                             \
         p = (type) _p;                                                        \
         JS_ArenaCountAllocation(pool, nb);                                    \
     JS_END_MACRO
@@ -136,11 +134,10 @@ struct JSArenaPool {
 #define JS_ARENA_GROW_CAST(p, type, pool, size, incr)                         \
     JS_BEGIN_MACRO                                                            \
         JSArena *_a = (pool)->current;                                        \
-        if (_a->avail == (jsuword)(p) + JS_ARENA_ALIGN(pool, size)) {         \
+        if (_a->avail - JS_ARENA_ALIGN(pool, size) == (jsuword)(p)) {         \
             size_t _nb = (size) + (incr);                                     \
-            jsuword _q = (jsuword)(p) + JS_ARENA_ALIGN(pool, _nb);            \
-            if (_q <= _a->limit) {                                            \
-                _a->avail = _q;                                               \
+            if ((jsuword)(p) <= _a->limit - JS_ARENA_ALIGN(pool, _nb)) {      \
+                _a->avail = (jsuword)(p) + JS_ARENA_ALIGN(pool, _nb);         \
                 JS_ArenaCountInplaceGrowth(pool, size, incr);                 \
             } else if ((jsuword)(p) == _a->base) {                            \
                 p = (type) JS_ArenaRealloc(pool, p, size, incr);              \
--- mozilla/js/src/jsarena.c.orig       2005-01-19 14:29:28.102175520 +0100
+++ mozilla/js/src/jsarena.c    2005-01-19 13:59:41.487473885 +0100
@@ -161,7 +161,7 @@ JS_ArenaAllocate(JSArenaPool *pool, size
 
     /* Search pool from current forward till we find or make enough space. */
     JS_ASSERT((nb & pool->mask) == 0);
-    for (a = pool->current; a->avail + nb > a->limit; pool->current = a) {
+    for (a = pool->current; a->avail > a->limit - nb; pool->current = a) {
         ap = &a->next;
         if (!*ap) {
             /* Not enough space in pool -- try to reclaim a free arena. */

Reply via email to