Bug 1127987 - Fix transposed parent/metadata arguments in EmptyShape::getInitialShape. r=jandem, a=sledru
authorBrian Hackett <bhackett1024@gmail.com>
Mon, 02 Feb 2015 09:27:59 -0700
changeset 249562 a053874061587604b54f8e54d629902dfb85cf73
parent 249561 0b5405689ec66b708425fc6e9070d796263e5cd3
child 249563 8f3d1a85d073ac0a9b89e66a9579e39e424a5a62
push id4489
push userraliiev@mozilla.com
push dateMon, 23 Feb 2015 15:17:55 +0000
treeherdermozilla-beta@fd7c3dc24146 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, sledru
bugs1127987
milestone37.0a2
Bug 1127987 - Fix transposed parent/metadata arguments in EmptyShape::getInitialShape. r=jandem, a=sledru
js/src/vm/Shape.cpp
js/src/vm/Shape.h
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -650,18 +650,18 @@ js::NewReshapedObject(JSContext *cx, Han
             nshape = nshape->previous();
         }
     }
 
     /* Construct the new shape, without updating type information. */
     RootedId id(cx);
     RootedShape newShape(cx, EmptyShape::getInitialShape(cx, res->getClass(),
                                                          res->getTaggedProto(),
+                                                         res->getParent(),
                                                          res->getMetadata(),
-                                                         res->getParent(),
                                                          res->numFixedSlots(),
                                                          shape->getObjectFlags()));
     for (unsigned i = 0; i < ids.length(); i++) {
         id = ids[i];
         MOZ_ASSERT(!res->contains(cx, id));
 
         uint32_t index;
         bool indexed = js_IdIsIndex(id, &index);
--- a/js/src/vm/Shape.h
+++ b/js/src/vm/Shape.h
@@ -1196,21 +1196,21 @@ struct EmptyShape : public js::Shape
 
     static Shape *new_(ExclusiveContext *cx, Handle<UnownedBaseShape *> base, uint32_t nfixed);
 
     /*
      * Lookup an initial shape matching the given parameters, creating an empty
      * shape if none was found.
      */
     static Shape *getInitialShape(ExclusiveContext *cx, const Class *clasp,
-                                  TaggedProto proto, JSObject *metadata,
-                                  JSObject *parent, size_t nfixed, uint32_t objectFlags = 0);
+                                  TaggedProto proto, JSObject *parent,
+                                  JSObject *metadata, size_t nfixed, uint32_t objectFlags = 0);
     static Shape *getInitialShape(ExclusiveContext *cx, const Class *clasp,
-                                  TaggedProto proto, JSObject *metadata,
-                                  JSObject *parent, gc::AllocKind kind, uint32_t objectFlags = 0);
+                                  TaggedProto proto, JSObject *parent,
+                                  JSObject *metadata, gc::AllocKind kind, uint32_t objectFlags = 0);
 
     /*
      * Reinsert an alternate initial shape, to be returned by future
      * getInitialShape calls, until the new shape becomes unreachable in a GC
      * and the table entry is purged.
      */
     static void insertInitialShape(ExclusiveContext *cx, HandleShape shape, HandleObject proto);