Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-25 05:41:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 650161 - Fix ObjectImpl::toDictionaryMode() to work with compacting GC r=terrence

Browse Source
This commit is contained in:
Jon Coppeard 2014-10-03 10:04:19 +01:00
parent 0ffd3e98e9
commit 211f9069dd
3 changed files with 13 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
js/src/jspropertytree.cpp
View File

@ -278,10 +278,10 @@ Shape::fixupDictionaryShapeAfterMovingGC()
return;
// It's possible that this shape is unreachable and that listp points to the
// location of a dead object in the nursery. In this case we should never
// touch it again, so poison it for good measure.
// location of a dead object in the nursery, in which case we should never
// touch it again.
if (IsInsideNursery(reinterpret_cast<Cell *>(listp))) {
JS_POISON(reinterpret_cast<void *>(this), JS_SWEPT_TENURED_PATTERN, sizeof(Shape));
listp = nullptr;
return;
}

24
js/src/vm/Shape.cpp
View File

@ -443,11 +443,6 @@ js::NativeObject::toDictionaryMode(ThreadSafeContext *cx)
{
MOZ_ASSERT(!inDictionaryMode());
#ifdef JSGC_COMPACTING
// TODO: This crashes if we run a compacting GC here.
js::AutoDisableCompactingGC nogc(zone()->runtimeFromAnyThread());
#endif
/* We allocate the shapes from cx->compartment(), so make sure it's right. */
MOZ_ASSERT(cx->isInsideCurrentCompartment(this));
@ -462,12 +457,9 @@ js::NativeObject::toDictionaryMode(ThreadSafeContext *cx)
Rooted<NativeObject*> self(cx, this);
/*
* Clone the shapes into a new dictionary list. Don't update the
* last property of this object until done, otherwise a GC
* triggered while creating the dictionary will get the wrong
* slot span for this object.
*/
// Clone the shapes into a new dictionary list. Don't update the last
// property of this object until done, otherwise a GC triggered while
// creating the dictionary will get the wrong slot span for this object.
RootedShape root(cx);
RootedShape dictionaryShape(cx);
@ -481,13 +473,13 @@ js::NativeObject::toDictionaryMode(ThreadSafeContext *cx)
return false;
}
HeapPtrShape *listp = dictionaryShape
? &dictionaryShape->parent
: (HeapPtrShape *) root.address();
HeapPtrShape *listp = dictionaryShape ? &dictionaryShape->parent : nullptr;
StackShape child(shape);
dprop->initDictionaryShape(child, self->numFixedSlots(), listp);
if (!dictionaryShape)
root = dprop;
MOZ_ASSERT(!dprop->hasTable());
dictionaryShape = dprop;
shape = shape->previous();
@ -498,7 +490,7 @@ js::NativeObject::toDictionaryMode(ThreadSafeContext *cx)
return false;
}
MOZ_ASSERT((Shape **) root->listp == root.address());
MOZ_ASSERT(root->listp == nullptr);
root->listp = &self->shape_;
self->shape_ = root;

3
js/src/vm/Shape.h
View File

@ -703,7 +703,8 @@ class Shape : public gc::TenuredCell
this->flags |= IN_DICTIONARY;
this->listp = nullptr;
insertIntoDictionary(dictp);
if (dictp)
insertIntoDictionary(dictp);
}
/* Replace the base shape of the last shape in a non-dictionary lineage with base. */