Fix savedEnumerators being stale (bug 731929, r=luke).
authorDavid Anderson <danderson@mozilla.com>
Fri, 02 Mar 2012 18:56:31 -0800
changeset 89285 3f39437bb2cc
parent 89284 f43cef7074c5
child 89286 1fd6c40d3852
push id680
push userdanderson@mozilla.com
push date2012-03-03 03:00 +0000
reviewersluke
bugs731929
milestone13.0a1
Fix savedEnumerators being stale (bug 731929, r=luke).
js/src/ion/CodeGenerator.cpp
js/src/ion/IonCompartment.h
js/src/ion/VMFunctions.cpp
js/src/ion/VMFunctions.h
--- a/js/src/ion/CodeGenerator.cpp
+++ b/js/src/ion/CodeGenerator.cpp
@@ -1533,17 +1533,17 @@ CodeGenerator::visitCallIteratorMore(LCa
 
     return true;
 }
 
 bool
 CodeGenerator::visitCallIteratorEnd(LCallIteratorEnd *lir)
 {
     typedef bool (*pf)(JSContext *, JSObject *);
-    static const VMFunction Info = FunctionInfo<pf>(CloseIterator);
+    static const VMFunction Info = FunctionInfo<pf>(CloseIteratorFromIon);
 
     const Register objReg = ToRegister(lir->getOperand(0));
 
     pushArg(objReg);
     return callVM(Info, lir);
 }
 
 bool
--- a/js/src/ion/IonCompartment.h
+++ b/js/src/ion/IonCompartment.h
@@ -225,15 +225,18 @@ class IonActivation
         return bailout_;
     }
     JSCompartment *compartment() const {
         return compartment_;
     }
     JSObject *savedEnumerators() const {
         return savedEnumerators_;
     }
+    void updateSavedEnumerators(JSObject *obj) {
+        savedEnumerators_ = obj;
+    }
 };
 
 } // namespace ion
 } // namespace js
 
 #endif // jsion_ion_compartment_h__
 
--- a/js/src/ion/VMFunctions.cpp
+++ b/js/src/ion/VMFunctions.cpp
@@ -34,16 +34,17 @@
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "Ion.h"
+#include "IonCompartment.h"
 #include "jsinterp.h"
 #include "ion/Snapshots.h"
 #include "ion/IonFrames.h"
 
 #include "jsinterpinlines.h"
 
 using namespace js;
 using namespace js::ion;
@@ -168,11 +169,23 @@ GreaterThanOrEqual(JSContext *cx, const 
 
 bool
 ValueToBooleanComplement(JSContext *cx, const Value &input, JSBool *output)
 {
     *output = !js_ValueToBoolean(input);
     return true;
 }
 
+bool
+CloseIteratorFromIon(JSContext *cx, JSObject *obj)
+{
+    bool result = CloseIterator(cx, obj);
+
+    IonActivation *ion = cx->runtime->ionActivation;
+    if (obj == ion->savedEnumerators())
+        ion->updateSavedEnumerators(cx->enumerators);
+
+    return result;
+}
+
 } // namespace ion
 } // namespace js
 
--- a/js/src/ion/VMFunctions.h
+++ b/js/src/ion/VMFunctions.h
@@ -312,13 +312,15 @@ bool StrictlyEqual(JSContext *cx, const 
 
 bool LessThan(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res);
 bool LessThanOrEqual(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res);
 bool GreaterThan(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res);
 bool GreaterThanOrEqual(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res);
 
 bool ValueToBooleanComplement(JSContext *cx, const Value &input, JSBool *output);
 
+bool CloseIteratorFromIon(JSContext *cx, JSObject *obj);
+
 } // namespace ion
 } // namespace js
 
 #endif // jsion_vm_functions_h_