Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-25 11:15:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1481093 - Also update children of typed object type descriptor objects when compacting r=sfink a=abillings

Browse Source
This commit is contained in:
Jon Coppeard 2018-08-13 13:21:34 +01:00
parent dcd6231961
commit babb91a3ce
3 changed files with 20 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
js/src/builtin/TypedObject.cpp
View File

@ -1002,9 +1002,7 @@ StructMetaTypeDescr::createFromArrays(JSContext* cx,
if (!CreateTraceList(cx, descr))
return nullptr;
if (!cx->zone()->addTypeDescrObject(cx, descr) ||
!cx->zone()->addTypeDescrObject(cx, fieldTypeVec))
{
if (!cx->zone()->addTypeDescrObject(cx, descr)) {
ReportOutOfMemory(cx);
return nullptr;
}

16
js/src/gc/GC.cpp
View File

@ -2778,9 +2778,21 @@ ForegroundUpdateKinds(AllocKinds kinds)
void
GCRuntime::updateTypeDescrObjects(MovingTracer* trc, Zone* zone)
{
// We need to update each type descriptor object and any objects stored in
// its slots, since some of these contain array objects which also need to
// be updated.
zone->typeDescrObjects().sweep();
for (auto r = zone->typeDescrObjects().all(); !r.empty(); r.popFront())
UpdateCellPointers(trc, r.front());
for (auto r = zone->typeDescrObjects().all(); !r.empty(); r.popFront()) {
NativeObject* obj = &r.front()->as<NativeObject>();
UpdateCellPointers(trc, obj);
for (size_t i = 0; i < obj->slotSpan(); i++) {
Value value = obj->getSlot(i);
if (value.isObject())
UpdateCellPointers(trc, &value.toObject());
}
}
}
void

5
js/src/jit-test/tests/gc/bug-1481093.js Normal file
View File

@ -0,0 +1,5 @@
v = new new TypedObject.StructType({
f: TypedObject.Any
})
gczeal(14);
var lfOffThreadGlobal = newGlobal();