Bug 1260371 - Forward another pointer during TypedObject tracing to fix bustage r=me
authorJon Coppeard <jcoppeard@mozilla.com>
Wed, 30 Mar 2016 15:02:18 +0100
changeset 291071 dc32b86990d5142169d46d9b1ac75c780d99442c
parent 291070 61241975d4dab068524ab4c77eb045f79815c058
child 291072 1fd5dcb62bc4be26d7de019bb978fd7970953f9b
push id19656
push usergwagner@mozilla.com
push dateMon, 04 Apr 2016 13:43:23 +0000
treeherderb2g-inbound@e99061fde28a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersme
bugs1260371
milestone48.0a1
Bug 1260371 - Forward another pointer during TypedObject tracing to fix bustage r=me
js/src/builtin/TypedObject.cpp
js/src/builtin/TypedObject.h
--- a/js/src/builtin/TypedObject.cpp
+++ b/js/src/builtin/TypedObject.cpp
@@ -2815,17 +2815,17 @@ visitReferences(TypeDescr& descr,
 
       case type::Reference:
         visitor.visitReference(descr.as<ReferenceTypeDescr>(), mem);
         return;
 
       case type::Array:
       {
         ArrayTypeDescr& arrayDescr = descr.as<ArrayTypeDescr>();
-        TypeDescr& elementDescr = *MaybeForwarded(&arrayDescr.elementType());
+        TypeDescr& elementDescr = arrayDescr.maybeForwardedElementType();
         for (int32_t i = 0; i < arrayDescr.length(); i++) {
             visitReferences(elementDescr, mem, visitor);
             mem += elementDescr.size();
         }
         return;
       }
 
       case type::Struct:
--- a/js/src/builtin/TypedObject.h
+++ b/js/src/builtin/TypedObject.h
@@ -397,16 +397,20 @@ class ArrayTypeDescr : public ComplexTyp
 {
   public:
     static const Class class_;
     static const type::Kind Kind = type::Array;
 
     TypeDescr& elementType() const {
         return getReservedSlot(JS_DESCR_SLOT_ARRAY_ELEM_TYPE).toObject().as<TypeDescr>();
     }
+    TypeDescr& maybeForwardedElementType() const {
+        JSObject* obj = MaybeForwarded(&getReservedSlot(JS_DESCR_SLOT_ARRAY_ELEM_TYPE).toObject());
+        return obj->as<TypeDescr>();
+    }
 
     int32_t length() const {
         return getReservedSlot(JS_DESCR_SLOT_ARRAY_LENGTH).toInt32();
     }
 
     static int32_t offsetOfLength() {
         return getFixedSlotOffset(JS_DESCR_SLOT_ARRAY_LENGTH);
     }