tor-browser

commit 705390917649c050676120ebd1e14499df3ac8ed
parent 2be192de165d8d3e3fc4aaf1a8b5500e6d47692f
Author: Nazım Can Altınova <canaltinova@gmail.com>
Date:   Wed,  3 Dec 2025 18:08:13 +0000

Bug 2003356 - Fix frameInfos array assertion after MaxDepth size change r=iain

In Bug 2002397, InlineScriptTree::MaxDepth was reduced from 64 to 8.
Since the frameInfos array can now be full (depth can equal MaxDepth),
the assertion here had to change as well.

Differential Revision: https://phabricator.services.mozilla.com/D274738

Diffstat:
M
js/src/vm/Stack.cpp
 | 
2
+-

1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp
@@ -767,7 +767,7 @@ uint32_t JS::ProfilingFrameIterator::extractStack(Frame* frames,
   uint32_t depth = entry->callStackAtAddr(cx_->runtime(),
                                           jsJitIter().resumePCinCurrentFrame(),
                                           frameInfos, std::size(frameInfos));
-  MOZ_ASSERT(depth < std::size(frameInfos));
+  MOZ_ASSERT(depth <= std::size(frameInfos));
   for (uint32_t i = 0; i < depth; i++) {
     if (offset + i >= end) {
       return i;