Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-10 17:24:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 629974 - js_TraceObject doesn't need to mark past slotSpan (r=brendan,a=blocking)

Browse Source
This commit is contained in:
Luke Wagner 2011-02-01 14:19:07 -08:00
parent ba6932d62b
commit c5b8ef5d99
2 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
js/src/jit-test/tests/basic/testBug629974.js Normal file
View File

@ -0,0 +1,7 @@
foo = {}
foo.y = 3;
foo.y = function () {}
Object.defineProperty(foo, "y", { set:function(){} })
gc()
delete foo.y
gc();

5
js/src/jsobj.cpp
View File

@ -6514,10 +6514,7 @@ js_TraceObject(JSTracer *trc, JSObject *obj)
* reserved slots (this Date issue may be a bug in JSObject::growSlots, but
* the general problem occurs in other built-in class implementations).
*/
uint32 nslots = obj->numSlots();
if (!obj->nativeEmpty() && obj->slotSpan() < nslots)
nslots = obj->slotSpan();
uint32 nslots = Min(obj->numSlots(), obj->slotSpan());
for (uint32 i = 0; i != nslots; ++i) {
const Value &v = obj->getSlot(i);
JS_SET_TRACING_DETAILS(trc, js_PrintObjectSlotName, obj, i);