Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-20 16:55:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1532376 - Assert that the group's shouldPretenure flag is respected when creating an object r=jandem

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D22326

--HG--
extra : source : 82a1c708780619b605a5c0f63cd8046f3e992692
This commit is contained in:
Jon Coppeard 2019-03-06 16:38:29 +00:00
parent fe432882de
commit 8311f852fb
2 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
js/src/vm/ArrayObject-inl.h
View File

@ -42,6 +42,8 @@ inline void ArrayObject::setLength(JSContext* cx, uint32_t length) {
MOZ_ASSERT_IF(clasp->hasFinalize(), heap == gc::TenuredHeap);
MOZ_ASSERT_IF(group->hasUnanalyzedPreliminaryObjects(),
heap == js::gc::TenuredHeap);
MOZ_ASSERT_IF(group->shouldPreTenureDontCheckGeneration(),
heap == gc::TenuredHeap);
// Arrays can use their fixed slots to store elements, so can't have shapes
// which allow named properties to be stored in the fixed slots.

2
js/src/vm/JSObject.cpp
View File

@ -4296,6 +4296,8 @@ void JSObject::debugCheckNewObject(ObjectGroup* group, Shape* shape,
clasp->isProxy());
MOZ_ASSERT_IF(group->hasUnanalyzedPreliminaryObjects(),
heap == gc::TenuredHeap);
MOZ_ASSERT_IF(group->shouldPreTenureDontCheckGeneration(),
heap == gc::TenuredHeap);
MOZ_ASSERT(!group->realm()->hasObjectPendingMetadata());