Bug 1247701 followup - Change ArrayShiftDenseKernel to receive handle. r=bz
authorTooru Fujisawa <arai_a@mac.com>
Wed, 17 Feb 2016 04:39:52 +0900
changeset 331399 98716dc7dbd981d3c7da9f951a5c76e99b724e91
parent 331398 387463b5c093b6e931efe1e697ab5183a29a9972
child 331400 221698ba7d337a3195bab02ad71e857dd4e8e7de
push id10977
push usercykesiopka.bmo@gmail.com
push dateWed, 17 Feb 2016 01:27:23 +0000
reviewersbz
bugs1247701
milestone47.0a1
Bug 1247701 followup - Change ArrayShiftDenseKernel to receive handle. r=bz
js/src/jsarray.cpp
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -2128,47 +2128,47 @@ js::ArrayShiftMoveElements(JSObject* obj
     MOZ_ASSERT_IF(obj->is<ArrayObject>(), obj->as<ArrayObject>().lengthIsWritable());
 
     ShiftMoveBoxedOrUnboxedDenseElementsFunctor functor(obj);
     JS_ALWAYS_TRUE(CallBoxedOrUnboxedSpecialization(functor, obj) == DenseElementResult::Success);
 }
 
 template <JSValueType Type>
 DenseElementResult
-ArrayShiftDenseKernel(JSContext* cx, JSObject* obj, Value* rval)
+ArrayShiftDenseKernel(JSContext* cx, HandleObject obj, MutableHandleValue rval)
 {
     if (ObjectMayHaveExtraIndexedProperties(obj))
         return DenseElementResult::Incomplete;
 
-    ObjectGroup* group = obj->getGroup(cx);
+    RootedObjectGroup group(cx, obj->getGroup(cx));
     if (MOZ_UNLIKELY(!group))
         return DenseElementResult::Failure;
 
     if (MOZ_UNLIKELY(group->hasAllFlags(OBJECT_FLAG_ITERATED)))
         return DenseElementResult::Incomplete;
 
     size_t initlen = GetBoxedOrUnboxedInitializedLength<Type>(obj);
     if (initlen == 0)
         return DenseElementResult::Incomplete;
 
-    *rval = GetBoxedOrUnboxedDenseElement<Type>(obj, 0);
-    if (rval->isMagic(JS_ELEMENTS_HOLE))
-        rval->setUndefined();
+    rval.set(GetBoxedOrUnboxedDenseElement<Type>(obj, 0));
+    if (rval.isMagic(JS_ELEMENTS_HOLE))
+        rval.setUndefined();
 
     DenseElementResult result = MoveBoxedOrUnboxedDenseElements<Type>(cx, obj, 0, 1, initlen - 1);
     MOZ_ASSERT(result != DenseElementResult::Incomplete);
     if (result == DenseElementResult::Failure)
         return DenseElementResult::Failure;
 
     SetBoxedOrUnboxedInitializedLength<Type>(cx, obj, initlen - 1);
     return DenseElementResult::Success;
 }
 
 DefineBoxedOrUnboxedFunctor3(ArrayShiftDenseKernel,
-                             JSContext*, JSObject*, Value*);
+                             JSContext*, HandleObject, MutableHandleValue);
 
 /* ES5 15.4.4.9 */
 bool
 js::array_shift(JSContext* cx, unsigned argc, Value* vp)
 {
     AutoSPSEntry pseudoFrame(cx->runtime(), "Array.prototype.shift");
     CallArgs args = CallArgsFromVp(argc, vp);
 
@@ -2191,17 +2191,17 @@ js::array_shift(JSContext* cx, unsigned 
         /* Step 4b. */
         args.rval().setUndefined();
         return true;
     }
 
     uint32_t newlen = len - 1;
 
     /* Fast paths. */
-    ArrayShiftDenseKernelFunctor functor(cx, obj, args.rval().address());
+    ArrayShiftDenseKernelFunctor functor(cx, obj, args.rval());
     DenseElementResult result = CallBoxedOrUnboxedSpecialization(functor, obj);
     if (result != DenseElementResult::Incomplete) {
         if (result == DenseElementResult::Failure)
             return false;
 
         return SetLengthProperty(cx, obj, newlen);
     }