Bug 900405 - Fix an incorrect assertion and missing check for minor GC; r=billm

This commit is contained in:
Terrence Cole 2013-08-01 13:18:44 -07:00
parent e8efd45946
commit 6c49f9ce91
3 changed files with 5 additions and 2 deletions

View File

@ -508,7 +508,7 @@ js::Nursery::moveElementsToTenured(JSObject *dst, JSObject *src, AllocKind dstKi
return nslots * sizeof(HeapSlot);
}
JS_ASSERT(nslots > 2);
JS_ASSERT(nslots >= 2);
size_t nbytes = nslots * sizeof(HeapValue);
dstHeader = static_cast<ObjectElements *>(zone->malloc_(nbytes));
if (!dstHeader)

View File

@ -0,0 +1,3 @@
(function() {
[{ "9": [] }.watch([], function(){})]
})()

View File

@ -587,7 +587,7 @@ JSObject::create(js::ExclusiveContext *cx, js::gc::AllocKind kind, js::gc::Initi
}
#ifdef JSGC_GENERATIONAL
if (heap != js::gc::TenuredHeap)
if (slots && heap != js::gc::TenuredHeap)
cx->asJSContext()->runtime()->gcNursery.notifyInitialSlots(obj, slots);
#endif