Bug 629974 - js_TraceObject doesn't need to mark past slotSpan (r=brendan)
authorLuke Wagner <lw@mozilla.com>
Tue, 01 Feb 2011 14:24:28 -0800
changeset 62045 c97ba1410e59d3dbb500101ca08118fdf65b6b1b
parent 62044 f1afdc854d3fd0ca4bfb82fc4a9093ca4f33fc24
child 62046 6882211c4a80df43d9ea10904ac26ada8fbd4875
push id18581
push usercleary@mozilla.com
push dateSun, 06 Feb 2011 23:32:36 +0000
treeherdermozilla-central@a02c6f4ffe4a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbrendan
bugs629974
milestone2.0b11pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 629974 - js_TraceObject doesn't need to mark past slotSpan (r=brendan)
js/src/jit-test/tests/basic/testBug629974.js
js/src/jsobj.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testBug629974.js
@@ -0,0 +1,7 @@
+foo = {}
+foo.y = 3;
+foo.y = function () {}
+Object.defineProperty(foo, "y", { set:function(){} })
+gc()
+delete foo.y
+gc();
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -6503,29 +6503,20 @@ js_TraceObject(JSTracer *trc, JSObject *
             (void) clasp->mark(cx, obj, trc);
     }
     if (clasp->flags & JSCLASS_IS_GLOBAL) {
         JSCompartment *compartment = obj->getCompartment();
         compartment->marked = true;
     }
 
     /*
-     * NB: In case clasp->mark mutates something (which would be a bug, but we
-     * want to be defensive), leave this code here -- don't move it up and
-     * unify it with the |if (!traceScope)| section above.
-     *
-     * FIXME: We minimize nslots against obj->slotSpan because native objects
-     * such as Date instances may have failed to advance slotSpan to cover all
-     * reserved slots (this Date issue may be a bug in JSObject::growSlots, but
-     * the general problem occurs in other built-in class implementations).
+     * NB: clasp->mark could mutate something (which would be a bug, but we are
+     * defensive), so don't hoist this above calling clasp->mark.
      */
-    uint32 nslots = obj->numSlots();
-    if (!obj->nativeEmpty() && obj->slotSpan() < nslots)
-        nslots = obj->slotSpan();
-
+    uint32 nslots = Min(obj->numSlots(), obj->slotSpan());
     for (uint32 i = 0; i != nslots; ++i) {
         const Value &v = obj->getSlot(i);
         JS_SET_TRACING_DETAILS(trc, js_PrintObjectSlotName, obj, i);
         MarkValueRaw(trc, v);
     }
 }
 
 void