Bug 1075546 r=terrence
authorJon Coppeard <jcoppeard@mozilla.com>
Wed, 08 Oct 2014 08:32:28 +0100
changeset 209271 4007aeccec79b33a9eae3506f26455ae3e01facc
parent 209270 40263f6c0fbc142ed3c1a28ad3d098bc0c0e12b8
child 209272 9da8f4e52207a8e9f96618cd0d4ec3535e165e13
push id27612
push usercbook@mozilla.com
push dateWed, 08 Oct 2014 13:46:10 +0000
treeherdermozilla-central@3a0d57d665bb [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersterrence
bugs1075546
milestone35.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1075546 r=terrence
js/src/jit-test/tests/gc/bug-1075546.js
js/src/jsobj.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1075546.js
@@ -0,0 +1,30 @@
+for (var i = 0; i < 200; ++i) {
+    Object.getOwnPropertyNames(undefined + "");
+}
+function p(s) {
+    for (var i = 0; i < s.length; i++) {
+        s.charCodeAt(i);
+    }
+}
+function m(f) {
+    var a = [];
+    for (var j = 0; j < 700; ++j) {
+        try {
+            f()
+        } catch (e) {
+            a.push(e.toString());
+        }
+    }
+    p(uneval(a));
+}
+f = Function("\
+    function f() {\
+        functionf\n{}\
+    }\
+    m(f);\
+");
+f();
+f();
+for (var x = 0; x < 99; x++) {
+    newGlobal()
+}
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1500,19 +1500,20 @@ js::NewObjectWithGivenProto(ExclusiveCon
                 } else {
                     Rooted<TaggedProto> proto(cxArg, protoArg);
                     RootedObject parent(cxArg, parentArg);
                     obj = cache.newObjectFromHit<CanGC>(cx, entry, GetInitialHeap(newKind, clasp));
                     MOZ_ASSERT(!obj);
                     parentArg = parent;
                     protoArg = proto;
                 }
+            } else {
+                gcNumber = rt->gc.gcNumber();
             }
         }
-        gcNumber = rt->gc.gcNumber();
     }
 
     Rooted<TaggedProto> proto(cxArg, protoArg);
     RootedObject parent(cxArg, parentArg);
 
     types::TypeObject *type = cxArg->getNewType(clasp, proto, nullptr);
     if (!type)
         return nullptr;