Bug 716176 - Trigger write barriers when copying BaseShapes; r=billm

Since getterObj and setterObj are hidden beneath unions, we need to manually
trigger their barriers.

--HG--
extra : rebase_source : c4936795ff5afbb23b77f680a4e607a6f1b722bd
This commit is contained in:
Terrence Cole 2012-01-09 16:08:24 -08:00
parent a33aa3815a
commit 0f79e55476
2 changed files with 24 additions and 0 deletions

View File

@ -341,6 +341,8 @@ class BaseShape : public js::gc::Cell
/* Not defined: BaseShapes must not be stack allocated. */
~BaseShape();
inline BaseShape &operator=(const BaseShape &other);
bool isOwned() const { return !!(flags & OWNED_SHAPE); }
inline bool matchesGetterSetter(PropertyOp rawGetter,

View File

@ -112,6 +112,28 @@ BaseShape::BaseShape(const StackBaseShape &base)
}
}
inline BaseShape &
BaseShape::operator=(const BaseShape &other)
{
clasp = other.clasp;
parent = other.parent;
flags = other.flags;
slotSpan_ = other.slotSpan_;
if (flags & HAS_GETTER_OBJECT) {
getterObj = other.getterObj;
JSObject::writeBarrierPost(getterObj, &getterObj);
} else {
rawGetter = other.rawGetter;
}
if (flags & HAS_SETTER_OBJECT) {
setterObj = other.setterObj;
JSObject::writeBarrierPost(setterObj, &setterObj);
} else {
rawSetter = other.rawSetter;
}
return *this;
}
inline bool
BaseShape::matchesGetterSetter(PropertyOp rawGetter, StrictPropertyOp rawSetter) const
{