Bug 940629 - Root StackShape across getChildPropertyOnDictionary calls, r=bhackett
authorSteve Fink <sfink@mozilla.com>
Tue, 19 Nov 2013 12:32:33 -0800
changeset 156632 e9294ddf600c7a2fde15d3e2902c8159a414aa97
parent 156631 2bf234be216eabbc9a19e7b3ec9ae62180c3c8f3
child 156633 335ec0f81eadfa80aaead3268dfb9d83657a8a88
push id25684
push usercbook@mozilla.com
push dateThu, 21 Nov 2013 13:21:05 +0000
treeherdermozilla-central@7427eede548f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs940629
milestone28.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 940629 - Root StackShape across getChildPropertyOnDictionary calls, r=bhackett
js/src/vm/Shape.cpp
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -388,16 +388,17 @@ JSObject::getChildPropertyOnDictionary(T
 
     return shape;
 }
 
 /* static */ Shape *
 JSObject::getChildProperty(ExclusiveContext *cx,
                            HandleObject obj, HandleShape parent, StackShape &child)
 {
+    StackShape::AutoRooter childRoot(cx, &child);
     RootedShape shape(cx, getChildPropertyOnDictionary(cx, obj, parent, child));
 
     if (!shape) {
         shape = cx->compartment()->propertyTree.getChild(cx, parent, obj->numFixedSlots(), child);
         if (!shape)
             return nullptr;
         //JS_ASSERT(shape->parent == parent);
         //JS_ASSERT_IF(parent != lastProperty(), parent == lastProperty()->parent);
@@ -407,16 +408,17 @@ JSObject::getChildProperty(ExclusiveCont
 
     return shape;
 }
 
 /* static */ Shape *
 JSObject::lookupChildProperty(ThreadSafeContext *cx,
                               HandleObject obj, HandleShape parent, StackShape &child)
 {
+    StackShape::AutoRooter childRoot(cx, &child);
     JS_ASSERT(cx->isThreadLocal(obj));
 
     RootedShape shape(cx, getChildPropertyOnDictionary(cx, obj, parent, child));
 
     if (!shape) {
         shape = cx->compartment_->propertyTree.lookupChild(cx, parent, child);
         if (!shape)
             return nullptr;