wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 948423 - Use relookupOrAdd() to insert into has type representation hash map following possible mutation by GC r=sfink

Browse Source
This commit is contained in:
Jon Coppeard 2013-12-12 11:22:00 +00:00
parent e309bf40ba
commit bd120cc016
2 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
js/src/builtin/TypeRepresentation.cpp
View File

@ -383,7 +383,7 @@ TypeRepresentation::addToTableOrFree(JSContext *cx,
return nullptr;
// Next, attempt to add the type representation to the table.
if (!comp->typeReprs.add(p, this)) {
if (!comp->typeReprs.relookupOrAdd(p, this, this)) {
js_ReportOutOfMemory(cx);
js_free(this); // do not finalize, not present in the table
return nullptr;

20
js/src/jit-test/tests/gc/bug-948423.js Normal file
View File

@ -0,0 +1,20 @@
var ArrayType = TypedObject.ArrayType;
var StructType = TypedObject.StructType;
var uint8 = TypedObject.uint8;
var uint32 = TypedObject.uint32;
var ObjectType = TypedObject.Object;
function runTests() {
(function DimensionLinkedToUndimension() {
var UintsA = uint32.array();
var FiveUintsA = UintsA.dimension(5);
var FiveUintsB = uint32.array(5);
assertEq(true,
FiveUintsA.equivalent(FiveUintsB)
);
})();
(function PrototypeHierarchy() {
schedulegc(3);
var Uint8s = uint8.array();
})();
}
runTests();