Bug 1032206 - Update barrier verifier for well-known symbols. r=terrence.
authorJason Orendorff <jorendorff@mozilla.com>
Mon, 30 Jun 2014 15:19:31 -0500
changeset 192509 1c82a99ef2b7435d2d58043878650ab1f8abbef8
parent 192508 03f72dc8cbb1d430d370343e1ae1880f357f3c43
child 192510 0197c59b8802b9871379efa94de8791cac7df4a1
push id27088
push usercbook@mozilla.com
push dateMon, 07 Jul 2014 12:19:04 +0000
treeherdermozilla-central@699348fd356b [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersterrence
bugs1032206
milestone33.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1032206 - Update barrier verifier for well-known symbols. r=terrence.
js/src/gc/Verifier.cpp
js/src/jit-test/tests/gc/bug-1032206.js
--- a/js/src/gc/Verifier.cpp
+++ b/js/src/gc/Verifier.cpp
@@ -298,19 +298,21 @@ CheckEdge(JSTracer *jstrc, void **thingp
 }
 
 static void
 AssertMarkedOrAllocated(const EdgeValue &edge)
 {
     if (!edge.thing || IsMarkedOrAllocated(static_cast<Cell *>(edge.thing)))
         return;
 
-    // Permanent atoms aren't marked during graph traversal.
+    // Permanent atoms and well-known symbols aren't marked during graph traversal.
     if (edge.kind == JSTRACE_STRING && static_cast<JSString *>(edge.thing)->isPermanentAtom())
         return;
+    if (edge.kind == JSTRACE_SYMBOL && static_cast<JS::Symbol *>(edge.thing)->isWellKnownSymbol())
+        return;
 
     char msgbuf[1024];
     const char *label = edge.label;
 
     JS_snprintf(msgbuf, sizeof(msgbuf), "[barrier verifier] Unmarked edge: %s", label);
     MOZ_ReportAssertionFailure(msgbuf, __FILE__, __LINE__);
     MOZ_CRASH();
 }
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1032206.js
@@ -0,0 +1,3 @@
+gczeal(4);
+var symbols = [Symbol(), Symbol("comet"), Symbol.for("moon"), Symbol.iterator, 0];
+for (var a of symbols) {}