tor-browser

commit 4e76786022b11d9a2c75d6a6508ffb2ef601b4a9
parent 8833d4eda230cb4325969725fd03458c3f9093b9
Author: Ryan Hunt <rhunt@eqrion.net>
Date:   Wed, 19 Nov 2025 16:23:16 +0000

Bug 1999435 - Fix error reporting for max params in asm.js. r=bvisness

If the syntax tree ends after arguments, we can get a nullptr. We
should report it while we have a valid statement node.

Differential Revision: https://phabricator.services.mozilla.com/D272326

Diffstat:
A
js/src/jit-test/tests/asm.js/bug1999435.js
 | 
14
++++++++++++++
M
js/src/wasm/AsmJS.cpp
 | 
8
++++----

2 files changed, 18 insertions(+), 4 deletions(-)
diff --git a/js/src/jit-test/tests/asm.js/bug1999435.js b/js/src/jit-test/tests/asm.js/bug1999435.js
@@ -0,0 +1,14 @@
+let module = `(function module() { "use asm";function foo(`;
+const count = 1005;
+for (let i = 0; i <= count; ++i) {
+  module += `arg${i},`;
+}
+module += `arg${count}){`;
+for (let i = 0; i <= count; ++i) {
+  module += `arg${i}=+arg${i};`;
+}
+
+try {
+  Function(module);
+} catch (e) {
+}
diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
@@ -3262,15 +3262,15 @@ static bool CheckArguments(FunctionValidatorShared& f, ParseNode** stmtIter,
       return false;
     }
 
+    if (argTypes->length() > MaxParams) {
+      return f.fail(stmt, "too many parameters");
+    }
+
     if (!f.addLocal(argpn, name, type)) {
       return false;
     }
   }
 
-  if (argTypes->length() > MaxParams) {
-    return f.fail(stmt, "too many parameters");
-  }
-
   *stmtIter = stmt;
   return true;
 }