Bug 868610 - Do not use the arena header when cloning object literals. r=billm
authorTerrence Cole <terrence@mozilla.com>
Thu, 02 May 2013 16:33:15 -0700
changeset 131283 a15fae0ee76e12b78862b98eb256da2c2d1d9901
parent 131282 54986162d9bdcdfa0ffa7ca91da3c5ad8f2ba71b
child 131284 25bce82749bc1934b8131e70613a4231584951b9
push id24654
push userryanvm@gmail.com
push dateThu, 09 May 2013 04:17:56 +0000
treeherdermozilla-central@ea059733677c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbillm
bugs868610
milestone23.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 868610 - Do not use the arena header when cloning object literals. r=billm
js/src/jsobj.cpp
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1776,18 +1776,23 @@ js::CloneObject(JSContext *cx, HandleObj
     return clone;
 }
 
 JSObject *
 js::CloneObjectLiteral(JSContext *cx, HandleObject parent, HandleObject srcObj)
 {
     Rooted<TypeObject*> typeObj(cx);
     typeObj = cx->global()->getOrCreateObjectPrototype(cx)->getNewType(cx, &ObjectClass);
+
+    JS_ASSERT(srcObj->getClass() == &ObjectClass);
+    AllocKind kind = GetBackgroundAllocKind(GuessObjectGCKind(srcObj->numFixedSlots()));
+    JS_ASSERT_IF(srcObj->isTenured(), kind == srcObj->tenuredGetAllocKind());
+
     RootedShape shape(cx, srcObj->lastProperty());
-    return NewReshapedObject(cx, typeObj, parent, srcObj->tenuredGetAllocKind(), shape);
+    return NewReshapedObject(cx, typeObj, parent, kind, shape);
 }
 
 struct JSObject::TradeGutsReserved {
     Vector<Value> avals;
     Vector<Value> bvals;
     int newafixed;
     int newbfixed;
     RootedShape newashape;