743868 - GC: fix barriers in SupressDeletedProperties

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Terrence Cole [:terrence]]

Attachment: v0

Right now, we simply stop tracing through deleted properties. This causes us to delete things that are still in the write buffer. We need to, in addition, set the reference to NULL to ensure that the write buffer doesn't dereference these dead entries.

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 613433 [details] [diff] [review]
v0

Review of attachment 613433 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsiter.cpp
@@ +1051,5 @@
>                          ni->props_end = ni->end() - 1;
>  
>                          /*
> +                         * This invokes the pre barrier on this element, since
> +                         * it's no longer going to be marked and ensures that

I think you want a comma between "marked" and "and".

Comment 2

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/053487b8f1f7

Comment 3

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

https://hg.mozilla.org/mozilla-central/rev/053487b8f1f7