wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 906243 - Handle shrinkSlots correctly for nursery things; r=jonco

Browse Source 
--HG--
extra : rebase_source : 7c7a94b64d6227f701590d9da14cd6e6f0cde019
This commit is contained in:
Terrence Cole 2013-09-04 08:46:00 -07:00
parent f3a1f4283a
commit c6607cee80
4 changed files with 27 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
js/src/gc/Nursery.cpp
View File

@ -181,6 +181,15 @@ js::Nursery::reallocateElements(JSContext *cx, JSObject *obj, ObjectElements *ol
return reinterpret_cast<ObjectElements *>(slots);
}
void
js::Nursery::freeSlots(JSContext *cx, HeapSlot *slots)
{
if (!isInside(slots)) {
hugeSlots.remove(slots);
js_free(slots);
}
}
HeapSlot *
js::Nursery::allocateHugeSlots(JSContext *cx, size_t nslots)
{

3
js/src/gc/Nursery.h
View File

@ -79,6 +79,9 @@ class Nursery
ObjectElements *reallocateElements(JSContext *cx, JSObject *obj, ObjectElements *oldHeader,
uint32_t oldCount, uint32_t newCount);
/* Free a slots array. */
void freeSlots(JSContext *cx, HeapSlot *slots);
/* Add a slots to our tracking list if it is out-of-line. */
void notifyInitialSlots(gc::Cell *cell, HeapSlot *slots);

12
js/src/jit-test/tests/gc/bug-906243.js Normal file
View File

@ -0,0 +1,12 @@
a2 = []
g = function() r
Object.defineProperty(a2, 0, {
set: function() {}
})
for (var x = 0; x < 70; ++x) {
Array.prototype.unshift.call(a2, g)
}
a2.length = 8
for each(e in [0, 0]) {
Array.prototype.shift.call(a2)
}

5
js/src/jsobj.cpp
View File

@ -2587,9 +2587,10 @@ FreeSlots(ExclusiveContext *cx, HeapSlot *slots)
{
// Note: threads without a JSContext do not have access to nursery allocated things.
#ifdef JSGC_GENERATIONAL
if (!cx->isJSContext() || !cx->asJSContext()->runtime()->gcNursery.isInside(slots))
if (cx->isJSContext())
return cx->asJSContext()->runtime()->gcNursery.freeSlots(cx->asJSContext(), slots);
#endif
js_free(slots);
js_free(slots);
}
/* static */ void