Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-29 21:25:35 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 722028 - Need write barrier for SuppressDeletedPropertyHelper (r=bhackett)

Browse Source
This commit is contained in:
Bill McCloskey 2012-02-10 18:32:18 -08:00
parent 5578343c66
commit f6419d58f3
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
js/src/jit-test/tests/basic/bug722028.js Normal file
View File

@ -0,0 +1,13 @@
gczeal(4);
var BUGNUMBER = 668024;
var summary =
print(BUGNUMBER + ": " + summary);
var arr = [0, 1, 2, 3, 4, 5, , 7];
var seen = [];
for (var p in arr) {
if (seen.indexOf(unescape) >= 0) {}
arr.splice(2, 3);
seen.push(p);
}

6
js/src/jsiter.cpp
View File

@ -1029,6 +1029,12 @@ SuppressDeletedPropertyHelper(JSContext *cx, JSObject *obj, StringPredicate pred
for (HeapPtr<JSFlatString> *p = idp; p + 1 != props_end; p++)
*p = *(p + 1);
ni->props_end = ni->end() - 1;
/*
* Invoke the write barrier on this element, since it's
* no longer going to be marked.
*/
ni->props_end->HeapPtr<JSFlatString>::~HeapPtr<JSFlatString>();
}
/* Don't reuse modified native iterators. */