Bug 794494 - Clear the right buffer link when pruning and reversing the list of ArrayBufferViews. r=billm

This commit is contained in:
Steve Fink 2012-09-26 14:24:37 -07:00
parent 484cefec2c
commit 644ee82385

View File

@ -551,7 +551,6 @@ ArrayBufferObject::sweepAll(JSRuntime *rt)
JSObject **views = GetViewList(&buffer->asArrayBuffer());
JS_ASSERT(*views);
JSObject *nextBuffer = BufferLink(*views);
SetBufferLink(*views, UNSET_BUFFER_LINK);
// Rebuild the list of views of the ArrayBuffer, discarding dead views
JSObject *prevLiveView = NULL;
@ -566,6 +565,8 @@ ArrayBufferObject::sweepAll(JSRuntime *rt)
view = nextView;
}
*views = prevLiveView;
if (*views)
SetBufferLink(*views, UNSET_BUFFER_LINK);
buffer = nextBuffer;
}