mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-25 11:15:34 +00:00
Bug 1481093 - Also update children of typed object type descriptor objects when compacting r=sfink a=abillings
This commit is contained in:
parent
dcd6231961
commit
babb91a3ce
@ -1002,9 +1002,7 @@ StructMetaTypeDescr::createFromArrays(JSContext* cx,
|
||||
if (!CreateTraceList(cx, descr))
|
||||
return nullptr;
|
||||
|
||||
if (!cx->zone()->addTypeDescrObject(cx, descr) ||
|
||||
!cx->zone()->addTypeDescrObject(cx, fieldTypeVec))
|
||||
{
|
||||
if (!cx->zone()->addTypeDescrObject(cx, descr)) {
|
||||
ReportOutOfMemory(cx);
|
||||
return nullptr;
|
||||
}
|
||||
|
@ -2778,9 +2778,21 @@ ForegroundUpdateKinds(AllocKinds kinds)
|
||||
void
|
||||
GCRuntime::updateTypeDescrObjects(MovingTracer* trc, Zone* zone)
|
||||
{
|
||||
// We need to update each type descriptor object and any objects stored in
|
||||
// its slots, since some of these contain array objects which also need to
|
||||
// be updated.
|
||||
|
||||
zone->typeDescrObjects().sweep();
|
||||
for (auto r = zone->typeDescrObjects().all(); !r.empty(); r.popFront())
|
||||
UpdateCellPointers(trc, r.front());
|
||||
|
||||
for (auto r = zone->typeDescrObjects().all(); !r.empty(); r.popFront()) {
|
||||
NativeObject* obj = &r.front()->as<NativeObject>();
|
||||
UpdateCellPointers(trc, obj);
|
||||
for (size_t i = 0; i < obj->slotSpan(); i++) {
|
||||
Value value = obj->getSlot(i);
|
||||
if (value.isObject())
|
||||
UpdateCellPointers(trc, &value.toObject());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
|
5
js/src/jit-test/tests/gc/bug-1481093.js
Normal file
5
js/src/jit-test/tests/gc/bug-1481093.js
Normal file
@ -0,0 +1,5 @@
|
||||
v = new new TypedObject.StructType({
|
||||
f: TypedObject.Any
|
||||
})
|
||||
gczeal(14);
|
||||
var lfOffThreadGlobal = newGlobal();
|
Loading…
Reference in New Issue
Block a user