712488 - GC: missing barrier in JSFunction clone

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Terrence Cole [:terrence]]

Attachment: v1

When we clone a function, we need post barriers after assigning the internal JSScript and JSObject pointers into the new object.

Comment 1

[Terrence Cole [:terrence]]

Attachment: v2

Much more elegant with Bill's IRL feedback.

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 583343 [details] [diff] [review]
v2

Review of attachment 583343 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsfun.cpp
@@ +2199,5 @@
>  
>      clone->nargs = fun->nargs;
>      clone->flags = fun->flags & ~JSFUN_EXTENDED;
> +    if (fun->isInterpreted()) {
> +        clone->initScript(fun->u.i.script_);

Please change fun->u.i.script_ to fun->script(). Otherwise it looks good.

Comment 3

[Terrence Cole [:terrence]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/a51c0f8b8be1

Comment 4

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/a51c0f8b8be1