Bug 1029299; r=billm

This commit is contained in:
Terrence Cole 2014-05-12 15:12:51 -07:00
parent 68cafd273a
commit 970588dd20

View File

@ -2379,6 +2379,17 @@ JSObject::TradeGuts(JSContext *cx, JSObject *a, JSObject *b, TradeGutsReserved &
JS_ASSERT(a->compartment() == b->compartment());
JS_ASSERT(a->is<JSFunction>() == b->is<JSFunction>());
/*
* Neither object may be in the nursery, but ensure we update any embedded
* nursery pointers in either object.
*/
#ifdef JSGC_GENERATIONAL
JS_ASSERT(!IsInsideNursery(a) && !IsInsideNursery(b));
cx->runtime()->gc.storeBuffer.putWholeCellFromMainThread(a);
cx->runtime()->gc.storeBuffer.putWholeCellFromMainThread(b);
#endif
JS::AutoCheckCannotGC nogc;
/*
* Swap the object's types, to restore their initial type information.
* The prototypes and classes of the objects were swapped in ReserveForTradeGuts.
@ -2420,17 +2431,6 @@ JSObject::TradeGuts(JSContext *cx, JSObject *a, JSObject *b, TradeGutsReserved &
js_memcpy(tmp, a, size);
js_memcpy(a, b, size);
js_memcpy(b, tmp, size);
#ifdef JSGC_GENERATIONAL
/*
* Trigger post barriers for fixed slots. JSObject bits are barriered
* below, in common with the other case.
*/
for (size_t i = 0; i < a->numFixedSlots(); ++i) {
HeapSlot::writeBarrierPost(a, HeapSlot::Slot, i, a->getSlot(i));
HeapSlot::writeBarrierPost(b, HeapSlot::Slot, i, b->getSlot(i));
}
#endif
} else {
/*
* If the objects are of differing sizes, use the space we reserved
@ -2486,13 +2486,6 @@ JSObject::TradeGuts(JSContext *cx, JSObject *a, JSObject *b, TradeGutsReserved &
reserved.newbslots = nullptr;
}
#ifdef JSGC_GENERATIONAL
Shape::writeBarrierPost(a->shape_, &a->shape_);
Shape::writeBarrierPost(b->shape_, &b->shape_);
types::TypeObject::writeBarrierPost(a->type_, &a->type_);
types::TypeObject::writeBarrierPost(b->type_, &b->type_);
#endif
if (a->inDictionaryMode())
a->lastProperty()->listp = &a->shape_;
if (b->inDictionaryMode())