Bug 981289 - Do not forget to mark non-argument properties on arguments objects; r=sfink
authorTerrence Cole <terrence@mozilla.com>
Mon, 10 Mar 2014 15:19:51 -0700
changeset 190084 753b8af2f2c05e24ea32a609b57404b9373fc689
parent 190083 7aa032d90c9120737fbd0963f042e27e31616568
child 190085 ef99254c03d2b54acfede0f11c96d961ef7876c7
push id3503
push userraliiev@mozilla.com
push dateMon, 28 Apr 2014 18:51:11 +0000
treeherdermozilla-beta@c95ac01e332e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssfink
bugs981289
milestone30.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 981289 - Do not forget to mark non-argument properties on arguments objects; r=sfink
js/src/gc/StoreBuffer.cpp
js/src/jit-test/tests/gc/bug-981289.js
--- a/js/src/gc/StoreBuffer.cpp
+++ b/js/src/gc/StoreBuffer.cpp
@@ -63,18 +63,17 @@ void
 StoreBuffer::WholeCellEdges::mark(JSTracer *trc)
 {
     JS_ASSERT(tenured->isTenured());
     JSGCTraceKind kind = GetGCThingTraceKind(tenured);
     if (kind <= JSTRACE_OBJECT) {
         JSObject *object = static_cast<JSObject *>(tenured);
         if (object->is<ArgumentsObject>())
             ArgumentsObject::trace(trc, object);
-        else
-            MarkChildren(trc, object);
+        MarkChildren(trc, object);
         return;
     }
 #ifdef JS_ION
     JS_ASSERT(kind == JSTRACE_JITCODE);
     static_cast<jit::JitCode *>(tenured)->trace(trc);
 #else
     MOZ_ASSUME_UNREACHABLE("Only objects can be in the wholeCellBuffer if IonMonkey is disabled.");
 #endif
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-981289.js
@@ -0,0 +1,8 @@
+gcPreserveCode();
+function test() {
+  for (var i=0; i<20; i++) {
+      arguments.x = {};
+      gc();
+  }
+}
+test();