GC: missing barriers in BaseShape's new constructor

RESOLVED FIXED in mozilla12

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: terrence, Assigned: terrence)

Tracking

Trunk
mozilla12
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment, 1 obsolete attachment)

(Assignee)

Description

6 years ago
Created attachment 585805 [details] [diff] [review]
v1

BaseShape's new copy constructor for StackBaseShape needs to be write barriered
like the existing constructor.
Attachment #585805 - Flags: review?(bhackett1024)
Comment on attachment 585805 [details] [diff] [review]
v1

Review of attachment 585805 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsscopeinlines.h
@@ +104,5 @@
>      this->flags = base.flags;
>      this->rawGetter = base.rawGetter;
>      this->rawSetter = base.rawSetter;
> +    if ((base.flags & HAS_GETTER_OBJECT) && base.rawGetter) {
> +        this->flags |= HAS_GETTER_OBJECT;

This line is unnecessary.

@@ +108,5 @@
> +        this->flags |= HAS_GETTER_OBJECT;
> +        JSObject::writeBarrierPost(this->getterObj, &this->getterObj);
> +    }
> +    if ((base.flags & HAS_SETTER_OBJECT) && base.rawSetter) {
> +        this->flags |= HAS_SETTER_OBJECT;

Ditto.
Attachment #585805 - Flags: review?(bhackett1024) → review+
(Assignee)

Comment 2

6 years ago
Created attachment 585903 [details] [diff] [review]
v2: Fixes applied.

Ah, right, we've already assigned the full flags word, unlike with the other constructor.  Thanks for the review!
Attachment #585805 - Attachment is obsolete: true
Attachment #585903 - Flags: review+
(Assignee)

Comment 3

6 years ago
http://hg.mozilla.org/integration/mozilla-inbound/rev/bb91dfae7007
https://hg.mozilla.org/mozilla-central/rev/bb91dfae7007
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla12
You need to log in before you can comment on or make changes to this bug.