From c5b8ef5d99caa873807579de0a71a4d519cb4cb5 Mon Sep 17 00:00:00 2001
From: Luke Wagner <lw@mozilla.com>
Date: Tue, 1 Feb 2011 14:19:07 -0800
Subject: [PATCH] Bug 629974 - js_TraceObject doesn't need to mark past
 slotSpan (r=brendan,a=blocking)

---
 js/src/jit-test/tests/basic/testBug629974.js | 7 +++++++
 js/src/jsobj.cpp                             | 5 +----
 2 files changed, 8 insertions(+), 4 deletions(-)
 create mode 100644 js/src/jit-test/tests/basic/testBug629974.js

diff --git a/js/src/jit-test/tests/basic/testBug629974.js b/js/src/jit-test/tests/basic/testBug629974.js
new file mode 100644
index 000000000000..50e7247f4f51
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testBug629974.js
@@ -0,0 +1,7 @@
+foo = {}
+foo.y = 3;
+foo.y = function () {}
+Object.defineProperty(foo, "y", { set:function(){} })
+gc()
+delete foo.y
+gc();
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 1b399a28d9b6..927a0bd8bcc4 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -6514,10 +6514,7 @@ js_TraceObject(JSTracer *trc, JSObject *obj)
      * reserved slots (this Date issue may be a bug in JSObject::growSlots, but
      * the general problem occurs in other built-in class implementations).
      */
-    uint32 nslots = obj->numSlots();
-    if (!obj->nativeEmpty() && obj->slotSpan() < nslots)
-        nslots = obj->slotSpan();
-
+    uint32 nslots = Min(obj->numSlots(), obj->slotSpan());
     for (uint32 i = 0; i != nslots; ++i) {
         const Value &v = obj->getSlot(i);
         JS_SET_TRACING_DETAILS(trc, js_PrintObjectSlotName, obj, i);