wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 714616: fix write barrier in Array.shift, r=billm

Browse Source 
--HG--
extra : rebase_source : 2fd10ab4cc3a93aee188ef6f9bbc388f66da2d37
This commit is contained in:
David Mandelin 2012-01-30 17:13:07 -08:00
parent 87cece16dc
commit 43badc67e6
4 changed files with 19 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
js/src/jit-test/tests/basic/bug714616.js Normal file
View File

@ -0,0 +1,8 @@
array1 = new Array();
size = 10;
for (i = 0; i < size; (array1.length)++)
{
array1.push(array1.shift());
++i
}

4
js/src/jsarray.cpp
View File

@ -2506,7 +2506,7 @@ mjit::stubs::ArrayShift(VMFrame &f)
* themselves.
*/
uint32_t initlen = obj->getDenseArrayInitializedLength();
obj->moveDenseArrayElements(0, 1, initlen);
obj->moveDenseArrayElementsUnbarriered(0, 1, initlen);
}
#endif /* JS_METHODJIT */
@ -2533,7 +2533,7 @@ js::array_shift(JSContext *cx, uintN argc, Value *vp)
args.rval() = obj->getDenseArrayElement(0);
if (args.rval().isMagic(JS_ARRAY_HOLE))
args.rval().setUndefined();
obj->moveDenseArrayElements(0, 1, length);
obj->moveDenseArrayElements(0, 1, obj->getDenseArrayInitializedLength() - 1);
obj->setDenseArrayInitializedLength(obj->getDenseArrayInitializedLength() - 1);
obj->setArrayLength(cx, length);
if (!js_SuppressDeletedProperty(cx, obj, INT_TO_JSID(length)))

1
js/src/jsobj.h
View File

@ -1066,6 +1066,7 @@ struct JSObject : js::gc::Cell
inline void copyDenseArrayElements(uintN dstStart, const js::Value *src, uintN count);
inline void initDenseArrayElements(uintN dstStart, const js::Value *src, uintN count);
inline void moveDenseArrayElements(uintN dstStart, uintN srcStart, uintN count);
inline void moveDenseArrayElementsUnbarriered(uintN dstStart, uintN srcStart, uintN count);
inline bool denseArrayHasInlineSlots() const;
/* Packed information for this array. */

9
js/src/jsobjinlines.h
View File

@ -607,7 +607,7 @@ inline void
JSObject::moveDenseArrayElements(uintN dstStart, uintN srcStart, uintN count)
{
JS_ASSERT(dstStart + count <= getDenseArrayCapacity());
JS_ASSERT(srcStart + count <= getDenseArrayCapacity());
JS_ASSERT(srcStart + count <= getDenseArrayInitializedLength());
/*
* Use a custom write barrier here since it's performance sensitive. We
@ -626,6 +626,13 @@ JSObject::moveDenseArrayElements(uintN dstStart, uintN srcStart, uintN count)
memmove(elements + dstStart, elements + srcStart, count * sizeof(js::Value));
}
inline void
JSObject::moveDenseArrayElementsUnbarriered(uintN dstStart, uintN srcStart, uintN count)
{
JS_ASSERT(!compartment()->needsBarrier());
memmove(elements + dstStart, elements + srcStart, count * sizeof(js::Value));
}
inline bool
JSObject::denseArrayHasInlineSlots() const
{