Bug 650161 - Fix bug in arena selection logic r=terence
authorJon Coppeard <jcoppeard@mozilla.com>
Wed, 29 Oct 2014 16:52:05 +0000
changeset 212989 f05aa42d06e9a06855db5e1d70b93e23f2073386
parent 212988 04ecddfdb50be21ab5bfab95ea8a278d9254d059
child 212990 3479b8c7cc8d4ce6d4af9853cc2c086beea28c43
push id27738
push usercbook@mozilla.com
push dateThu, 30 Oct 2014 13:46:07 +0000
treeherdermozilla-central@1aa1b23d799e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersterence
bugs650161
milestone36.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 650161 - Fix bug in arena selection logic r=terence
js/src/jsgc.cpp
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -2189,16 +2189,19 @@ ArenaList::pickArenasToRelocate()
     // we can move into existing arenas, and we choose the least full areans to
     // relocate.
     //
     // This is made easier by the fact that the arena list has been sorted in
     // descending order of number of used cells, so we will always relocate a
     // tail of the arena list. All we need to do is find the point at which to
     // start relocating.
 
+    if (isCursorAtEnd())
+        return nullptr;
+
     ArenaHeader **arenap = cursorp_;               // Next arena to consider
     size_t previousFreeCells = 0;                  // Count of free cells before
     size_t followingUsedCells = countUsedCells();  // Count of used cells after
     mozilla::DebugOnly<size_t> lastFreeCells(0);
     size_t cellsPerArena = Arena::thingsPerArena((*arenap)->getThingSize());
 
     while (*arenap) {
         ArenaHeader *arena = *arenap;