From f5e8d2edbd550dc2e4b3a6e76d785c1570b240e6 Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Wed, 16 Mar 2011 18:24:20 -0700
Subject: [PATCH] [INFER] Spot fix for shapes not being marked when a child is
 held by AutoShapeRooter, bug 642209.

---
 js/src/jsapi.cpp        |  2 +-
 js/src/jsdbgapi.cpp     |  2 +-
 js/src/jsgc.cpp         |  2 +-
 js/src/jsgcinlines.h    |  2 +-
 js/src/jsinfer.cpp      |  2 +-
 js/src/jsscope.cpp      | 36 +++++++++++++++++++-----------------
 js/src/jsscope.h        |  2 +-
 js/src/jsscopeinlines.h |  4 +---
 js/src/jsscript.cpp     |  2 +-
 9 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index c5473ef1e568..c209eb5e5d35 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -4103,7 +4103,7 @@ prop_iter_trace(JSTracer *trc, JSObject *obj)
 
     if (obj->getSlot(JSSLOT_ITER_INDEX).toInt32() < 0) {
         /* Native case: just mark the next property to visit. */
-        ((Shape *) pdata)->trace(trc);
+        Shape::trace(trc, (Shape *) pdata);
     } else {
         /* Non-native case: mark each id in the JSIdArray private. */
         JSIdArray *ida = (JSIdArray *) pdata;
diff --git a/js/src/jsdbgapi.cpp b/js/src/jsdbgapi.cpp
index f08a06ecd2d8..60aadda24b7e 100644
--- a/js/src/jsdbgapi.cpp
+++ b/js/src/jsdbgapi.cpp
@@ -651,7 +651,7 @@ js_TraceWatchPoints(JSTracer *trc)
         if (wp->object->isMarked()) {
             if (!wp->shape->marked()) {
                 modified = true;
-                wp->shape->trace(trc);
+                Shape::trace(trc, wp->shape);
             }
             if (wp->shape->hasSetterValue() && wp->setter) {
                 if (!CastAsObject(wp->setter)->isMarked()) {
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 267527ec4c2c..85f068391533 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -1517,7 +1517,7 @@ AutoGCRooter::trace(JSTracer *trc)
         return;
 
       case SHAPE:
-        static_cast<AutoShapeRooter *>(this)->shape->trace(trc);
+        Shape::trace(trc, static_cast<AutoShapeRooter *>(this)->shape);
         return;
 
       case PARSER:
diff --git a/js/src/jsgcinlines.h b/js/src/jsgcinlines.h
index 0a11fbdb162c..e9d2685eae7d 100644
--- a/js/src/jsgcinlines.h
+++ b/js/src/jsgcinlines.h
@@ -641,7 +641,7 @@ MarkShapeRange(JSTracer *trc, const Shape **beg, const Shape **end, const char *
 {
     for (const Shape **sp = beg; sp < end; ++sp) {
         JS_SET_TRACING_INDEX(trc, name, sp - beg);
-        (*sp)->trace(trc);
+        Shape::trace(trc, *sp);
     }
 }
 
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index adecf39dd136..9c60d5ac8e07 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -4196,7 +4196,7 @@ types::TypeObject::trace(JSTracer *trc)
         int count = gc::FINALIZE_OBJECT_LAST - gc::FINALIZE_OBJECT0 + 1;
         for (int i = 0; i < count; i++) {
             if (emptyShapes[i])
-                emptyShapes[i]->trace(trc);
+                Shape::trace(trc, emptyShapes[i]);
         }
     }
 
diff --git a/js/src/jsscope.cpp b/js/src/jsscope.cpp
index 078352ca9997..20b1a17f1bd1 100644
--- a/js/src/jsscope.cpp
+++ b/js/src/jsscope.cpp
@@ -1423,26 +1423,28 @@ PrintPropertyMethod(JSTracer *trc, char *buf, size_t bufsize)
 #endif
 
 void
-Shape::trace(JSTracer *trc) const
+Shape::trace(JSTracer *trc, const Shape *shape)
 {
-    if (IS_GC_MARKING_TRACER(trc))
-        mark();
+    do {
+        if (IS_GC_MARKING_TRACER(trc))
+            shape->mark();
 
-    MarkId(trc, id, "id");
+        MarkId(trc, shape->id, "id");
 
-    if (attrs & (JSPROP_GETTER | JSPROP_SETTER)) {
-        if ((attrs & JSPROP_GETTER) && rawGetter) {
-            JS_SET_TRACING_DETAILS(trc, PrintPropertyGetterOrSetter, this, 0);
-            Mark(trc, getterObject());
+        if (shape->attrs & (JSPROP_GETTER | JSPROP_SETTER)) {
+            if ((shape->attrs & JSPROP_GETTER) && shape->rawGetter) {
+                JS_SET_TRACING_DETAILS(trc, PrintPropertyGetterOrSetter, shape, 0);
+                Mark(trc, shape->getterObject());
+            }
+            if ((shape->attrs & JSPROP_SETTER) && shape->rawSetter) {
+                JS_SET_TRACING_DETAILS(trc, PrintPropertyGetterOrSetter, shape, 1);
+                Mark(trc, shape->setterObject());
+            }
         }
-        if ((attrs & JSPROP_SETTER) && rawSetter) {
-            JS_SET_TRACING_DETAILS(trc, PrintPropertyGetterOrSetter, this, 1);
-            Mark(trc, setterObject());
-        }
-    }
 
-    if (isMethod()) {
-        JS_SET_TRACING_DETAILS(trc, PrintPropertyMethod, this, 0);
-        Mark(trc, &methodObject());
-    }
+        if (shape->isMethod()) {
+            JS_SET_TRACING_DETAILS(trc, PrintPropertyMethod, shape, 0);
+            Mark(trc, &shape->methodObject());
+        }
+    } while ((shape = shape->parent) != NULL && !shape->marked());
 }
diff --git a/js/src/jsscope.h b/js/src/jsscope.h
index 0a76cf660973..759897f356a2 100644
--- a/js/src/jsscope.h
+++ b/js/src/jsscope.h
@@ -592,7 +592,7 @@ struct Shape : public JSObjectMap
 
     inline bool isSharedPermanent() const;
 
-    void trace(JSTracer *trc) const;
+    static void trace(JSTracer *trc, const Shape *shape);
 
     bool hasSlot() const { return (attrs & JSPROP_SHARED) == 0; }
 
diff --git a/js/src/jsscopeinlines.h b/js/src/jsscopeinlines.h
index b94f41e82e0e..e34ac48afbe3 100644
--- a/js/src/jsscopeinlines.h
+++ b/js/src/jsscopeinlines.h
@@ -159,9 +159,7 @@ JSObject::trace(JSTracer *trc)
     }
 
     /* Trace our property tree or dictionary ancestor line. */
-    do {
-        shape->trace(trc);
-    } while ((shape = shape->parent) != NULL && !shape->marked());
+    js::Shape::trace(trc, shape);
 }
 
 namespace js {
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index 369f48b57088..3ae71b4cc57f 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -294,7 +294,7 @@ void
 Bindings::trace(JSTracer *trc)
 {
     for (const Shape *shape = lastBinding; shape; shape = shape->previous())
-        shape->trace(trc);
+        Shape::trace(trc, shape);
 }
 
 } /* namespace js */