Use js_free on fresh slots instead of js_delete (bug 793385, r=billm).
authorDavid Anderson <danderson@mozilla.com>
Mon, 24 Sep 2012 14:41:00 -0700
changeset 107942 b01c3760fce63ef5fe474dd5bc21f60b944003db
parent 107941 426fd9c738348e9673283352d9692c26dcf9591a
child 107943 c1003f039c77434e6a457a4e1f8f61e30b1a49f8
push id23524
push useremorley@mozilla.com
push dateTue, 25 Sep 2012 13:14:59 +0000
treeherdermozilla-central@7c7639f797d0 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbillm
bugs793385
milestone18.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Use js_free on fresh slots instead of js_delete (bug 793385, r=billm).
js/src/jit-test/tests/bug793385.js
js/src/vm/ScopeObject.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/bug793385.js
@@ -0,0 +1,9 @@
+// |jit-test| error: out of memory
+gcparam("maxBytes", gcparam("gcBytes") + 4*1024);
+function f() {
+    var inner4 = f("get"),
+	x1,x2,x3,x4,x5,x11,x12,x13,x14,x15,x16,x17,x18,
+        otherGlobalSameCompartment = newGlobal("same-compartment");
+    eval('');
+}
+assertEq("aaa".replace(/a/g, f()), "poniesponiesponies");
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -165,17 +165,17 @@ CallObject::createTemplateObject(JSConte
         return NULL;
 
     HeapSlot *slots;
     if (!PreallocateObjectDynamicSlots(cx, shape, &slots))
         return NULL;
 
     CallObject *callobj = CallObject::create(cx, shape, type, slots);
     if (!callobj) {
-        js_delete(slots);
+        js_free(slots);
         return NULL;
     }
 
     return callobj;
 }
 
 /*
  * Construct a call object for the given bindings.  If this is a call object