Bug 1389974 - Avoid taking reference to temporary Value because it hides from hazard analysis, r=jonco
authorSteve Fink <sfink@mozilla.com>
Wed, 30 Aug 2017 16:35:34 -0700
changeset 429583 1690554a9c01102e6a8b585d7390a5e100559f04
parent 429582 1c2a0b70e4472127ee39745b962fc81c8e263cfd
child 429584 ee991c185e3d1cc943d76afde2e9c6aeacb66f1b
push id7761
push userjlund@mozilla.com
push dateFri, 15 Sep 2017 00:19:52 +0000
treeherdermozilla-beta@c38455951db4 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjonco
bugs1389974
milestone57.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1389974 - Avoid taking reference to temporary Value because it hides from hazard analysis, r=jonco
js/src/jsarray.cpp
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -1237,17 +1237,17 @@ ArrayJoinDenseKernel(JSContext* cx, Sepa
     uint64_t initLength = Min<uint64_t>(GetBoxedOrUnboxedInitializedLength<Type>(obj), length);
     MOZ_ASSERT(initLength <= UINT32_MAX, "initialized length shouldn't exceed UINT32_MAX");
     uint32_t initLengthClamped = uint32_t(initLength);
     while (*numProcessed < initLengthClamped) {
         if (!CheckForInterrupt(cx))
             return DenseElementResult::Failure;
 
         // Step 7.b.
-        const Value& elem = GetBoxedOrUnboxedDenseElement<Type>(obj, *numProcessed);
+        Value elem = GetBoxedOrUnboxedDenseElement<Type>(obj, *numProcessed);
 
         // Steps 7.c-d.
         if (elem.isString()) {
             if (!sb.append(elem.toString()))
                 return DenseElementResult::Failure;
         } else if (elem.isNumber()) {
             if (!NumberValueToStringBuffer(cx, elem, sb))
                 return DenseElementResult::Failure;