From e5587dd58a048af14128992ac2059b7cd20d8631 Mon Sep 17 00:00:00 2001 From: Ed Morley Date: Fri, 14 Mar 2014 16:54:20 +0000 Subject: [PATCH 1/3] Bug 918507 - Disable browser_dbg_chrome-create.js on the remaining platforms, since it doesn't clean up after itself; CLOSED TREE --- browser/devtools/debugger/test/browser.ini | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browser/devtools/debugger/test/browser.ini b/browser/devtools/debugger/test/browser.ini index a4cdf1c873fa..18cde9f37524 100644 --- a/browser/devtools/debugger/test/browser.ini +++ b/browser/devtools/debugger/test/browser.ini @@ -272,7 +272,7 @@ support-files = [browser_dbg_watch-expressions-01.js] [browser_dbg_watch-expressions-02.js] [browser_dbg_chrome-create.js] -skip-if = os == "linux" # Bug 847558 +skip-if = true # Test doesn't clean up after itself (bug 918507), but also bug 847558 on Linux [browser_dbg_on-pause-raise.js] skip-if = os == "linux" # Bug 888811 & bug 891176 [browser_dbg_break-on-dom-event.js] From e0f8913903ccb43c106be3b9471ab9da7e6faa91 Mon Sep 17 00:00:00 2001 From: Jeff Walden Date: Fri, 14 Mar 2014 13:47:49 -0700 Subject: [PATCH 2/3] Bug 983344. r=sfink --- js/src/vm/TypedArrayObject.cpp | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/js/src/vm/TypedArrayObject.cpp b/js/src/vm/TypedArrayObject.cpp index cd624152043e..cecc14666c0d 100644 --- a/js/src/vm/TypedArrayObject.cpp +++ b/js/src/vm/TypedArrayObject.cpp @@ -907,6 +907,10 @@ class TypedArrayObjectTemplate : public TypedArrayObject copyFromArray(JSContext *cx, HandleObject thisTypedArrayObj, HandleObject ar, uint32_t len, uint32_t offset = 0) { + // Exit early if nothing to copy, to simplify loop conditions below. + if (len == 0) + return true; + Rooted thisTypedArray(cx, &thisTypedArrayObj->as()); JS_ASSERT(offset <= thisTypedArray->length()); JS_ASSERT(len <= thisTypedArray->length() - offset); @@ -914,7 +918,9 @@ class TypedArrayObjectTemplate : public TypedArrayObject return copyFromTypedArray(cx, thisTypedArray, ar, offset); JSRuntime *runtime = cx->runtime(); +#ifdef DEBUG uint64_t gcNumber = runtime->gcNumber; +#endif NativeType *dest = static_cast(thisTypedArray->viewData()) + offset; SkipRoot skipDest(cx, &dest); @@ -929,33 +935,33 @@ class TypedArrayObjectTemplate : public TypedArrayObject */ const Value *src = ar->getDenseElements(); SkipRoot skipSrc(cx, &src); - for (uint32_t i = 0; i < len; ++i) { + uint32_t i = 0; + do { NativeType n; if (!nativeFromValue(cx, src[i], &n)) return false; dest[i] = n; - } + } while (++i < len); JS_ASSERT(runtime->gcNumber == gcNumber); } else { RootedValue v(cx); - for (uint32_t i = 0; i < len; ++i) { + uint32_t i = 0; + do { if (!JSObject::getElement(cx, ar, ar, i, &v)) return false; NativeType n; if (!nativeFromValue(cx, v, &n)) return false; - /* - * Detect when a GC has occurred so we can update the dest - * pointers in case it has been moved. - */ - if (runtime->gcNumber != gcNumber) { - dest = static_cast(thisTypedArray->viewData()) + offset; - gcNumber = runtime->gcNumber; - } + len = Min(len, thisTypedArray->length()); + if (i >= len) + break; + + // Compute every iteration in case getElement acts wacky. + dest = static_cast(thisTypedArray->viewData()) + offset; dest[i] = n; - } + } while (++i < len); } return true; From 401f1acb0158f688fc013f9badbd02ed43680eb6 Mon Sep 17 00:00:00 2001 From: Steve Fink Date: Fri, 14 Mar 2014 16:23:11 -0700 Subject: [PATCH 3/3] Bug 983344 followup warning fix --- js/src/vm/TypedArrayObject.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/js/src/vm/TypedArrayObject.cpp b/js/src/vm/TypedArrayObject.cpp index cecc14666c0d..3e7dc77fc455 100644 --- a/js/src/vm/TypedArrayObject.cpp +++ b/js/src/vm/TypedArrayObject.cpp @@ -917,8 +917,8 @@ class TypedArrayObjectTemplate : public TypedArrayObject if (ar->is()) return copyFromTypedArray(cx, thisTypedArray, ar, offset); - JSRuntime *runtime = cx->runtime(); #ifdef DEBUG + JSRuntime *runtime = cx->runtime(); uint64_t gcNumber = runtime->gcNumber; #endif