Bug 629974 - js_TraceObject doesn't need to mark past slotSpan (r=brendan,a=blocking)
authorLuke Wagner <lw@mozilla.com>
Tue, 01 Feb 2011 14:19:07 -0800
changeset 61754 6de40288cc33484324ad06e2da274abd0597fed8
parent 61753 1c4fcf164f1836bf2ce127d26496c4cfd23ff250
child 61755 a8ca394b3a40f611f1860fb8be2530d02e64f1fa
push id18469
push userlwagner@mozilla.com
push dateTue, 01 Feb 2011 22:20:06 +0000
treeherdermozilla-central@6de40288cc33 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbrendan, blocking
bugs629974
milestone2.0b11pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 629974 - js_TraceObject doesn't need to mark past slotSpan (r=brendan,a=blocking)
js/src/jit-test/tests/basic/testBug629974.js
js/src/jsobj.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testBug629974.js
@@ -0,0 +1,7 @@
+foo = {}
+foo.y = 3;
+foo.y = function () {}
+Object.defineProperty(foo, "y", { set:function(){} })
+gc()
+delete foo.y
+gc();
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -6509,20 +6509,17 @@ js_TraceObject(JSTracer *trc, JSObject *
      * want to be defensive), leave this code here -- don't move it up and
      * unify it with the |if (!traceScope)| section above.
      *
      * FIXME: We minimize nslots against obj->slotSpan because native objects
      * such as Date instances may have failed to advance slotSpan to cover all
      * reserved slots (this Date issue may be a bug in JSObject::growSlots, but
      * the general problem occurs in other built-in class implementations).
      */
-    uint32 nslots = obj->numSlots();
-    if (!obj->nativeEmpty() && obj->slotSpan() < nslots)
-        nslots = obj->slotSpan();
-
+    uint32 nslots = Min(obj->numSlots(), obj->slotSpan());
     for (uint32 i = 0; i != nslots; ++i) {
         const Value &v = obj->getSlot(i);
         JS_SET_TRACING_DETAILS(trc, js_PrintObjectSlotName, obj, i);
         MarkValueRaw(trc, v);
     }
 }
 
 void