Bug 929151 - JS_ASSERT(good), not JS_ASSERT(bad). r=bustage
authorSteve Fink <sfink@mozilla.com>
Tue, 22 Oct 2013 16:24:42 -0700
changeset 165546 a2622f8515348b0fff48b5774dcdc05e2d2c99b8
parent 165545 30c52c82e37b7ed3a95a0e1d3b0c9959568d5c20
child 165547 c9879b47c32c5b821bd38e593698485a291b4e85
push id3066
push userakeybl@mozilla.com
push dateMon, 09 Dec 2013 19:58:46 +0000
treeherdermozilla-beta@a31a0dce83aa [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbustage
bugs929151
milestone27.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 929151 - JS_ASSERT(good), not JS_ASSERT(bad). r=bustage
js/src/vm/Shape.cpp
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -1615,17 +1615,17 @@ NewObjectCache::invalidateEntriesForShap
 EmptyShape::insertInitialShape(ExclusiveContext *cx, HandleShape shape, HandleObject proto)
 {
     InitialShapeEntry::Lookup lookup(shape->getObjectClass(), TaggedProto(proto),
                                      shape->getObjectParent(), shape->getObjectMetadata(),
                                      shape->numFixedSlots(), shape->getObjectFlags());
 
     /* Bug 929547 - we do not rekey based on metadata object moves */
     JSObject *metadata = shape->getObjectMetadata();
-    JS_ASSERT_IF(metadata, gc::IsInsideNursery(cx->compartment()->runtimeFromAnyThread(), metadata));
+    JS_ASSERT_IF(metadata, !gc::IsInsideNursery(cx->compartment()->runtimeFromAnyThread(), metadata));
 
     InitialShapeSet::Ptr p = cx->compartment()->initialShapes.lookup(lookup);
     JS_ASSERT(p);
 
     InitialShapeEntry &entry = const_cast<InitialShapeEntry &>(*p);
 
     /* The new shape had better be rooted at the old one. */
 #ifdef DEBUG