Bug 629974 - js_TraceObject doesn't need to mark past slotSpan (r=brendan)
authorLuke Wagner <lw@mozilla.com>
Tue, 01 Feb 2011 14:24:28 -0800
changeset 62045 c97ba1410e59d3dbb500101ca08118fdf65b6b1b
parent 62044 f1afdc854d3fd0ca4bfb82fc4a9093ca4f33fc24
child 62046 6882211c4a80df43d9ea10904ac26ada8fbd4875
push id1
push userroot
push dateTue, 10 Dec 2013 15:46:25 +0000
reviewersbrendan
bugs629974
milestone2.0b11pre
Bug 629974 - js_TraceObject doesn't need to mark past slotSpan (r=brendan)
js/src/jit-test/tests/basic/testBug629974.js
js/src/jsobj.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testBug629974.js
@@ -0,0 +1,7 @@
+foo = {}
+foo.y = 3;
+foo.y = function () {}
+Object.defineProperty(foo, "y", { set:function(){} })
+gc()
+delete foo.y
+gc();
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -6503,29 +6503,20 @@ js_TraceObject(JSTracer *trc, JSObject *
             (void) clasp->mark(cx, obj, trc);
     }
     if (clasp->flags & JSCLASS_IS_GLOBAL) {
         JSCompartment *compartment = obj->getCompartment();
         compartment->marked = true;
     }
 
     /*
-     * NB: In case clasp->mark mutates something (which would be a bug, but we
-     * want to be defensive), leave this code here -- don't move it up and
-     * unify it with the |if (!traceScope)| section above.
-     *
-     * FIXME: We minimize nslots against obj->slotSpan because native objects
-     * such as Date instances may have failed to advance slotSpan to cover all
-     * reserved slots (this Date issue may be a bug in JSObject::growSlots, but
-     * the general problem occurs in other built-in class implementations).
+     * NB: clasp->mark could mutate something (which would be a bug, but we are
+     * defensive), so don't hoist this above calling clasp->mark.
      */
-    uint32 nslots = obj->numSlots();
-    if (!obj->nativeEmpty() && obj->slotSpan() < nslots)
-        nslots = obj->slotSpan();
-
+    uint32 nslots = Min(obj->numSlots(), obj->slotSpan());
     for (uint32 i = 0; i != nslots; ++i) {
         const Value &v = obj->getSlot(i);
         JS_SET_TRACING_DETAILS(trc, js_PrintObjectSlotName, obj, i);
         MarkValueRaw(trc, v);
     }
 }
 
 void