715201 - GC: missing barriers in BaseShape's new constructor

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Terrence Cole [:terrence]]

Attachment: v1

BaseShape's new copy constructor for StackBaseShape needs to be write barriered
like the existing constructor.

Comment 1

[Brian Hackett [Laid off!]]

Comment on attachment 585805 [details] [diff] [review]
v1

Review of attachment 585805 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsscopeinlines.h
@@ +104,5 @@
>      this->flags = base.flags;
>      this->rawGetter = base.rawGetter;
>      this->rawSetter = base.rawSetter;
> +    if ((base.flags & HAS_GETTER_OBJECT) && base.rawGetter) {
> +        this->flags |= HAS_GETTER_OBJECT;

This line is unnecessary.

@@ +108,5 @@
> +        this->flags |= HAS_GETTER_OBJECT;
> +        JSObject::writeBarrierPost(this->getterObj, &this->getterObj);
> +    }
> +    if ((base.flags & HAS_SETTER_OBJECT) && base.rawSetter) {
> +        this->flags |= HAS_SETTER_OBJECT;

Ditto.

Comment 2

[Terrence Cole [:terrence]]

Attachment: v2: Fixes applied.

Ah, right, we've already assigned the full flags word, unlike with the other constructor.  Thanks for the review!

Comment 3

[Terrence Cole [:terrence]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/bb91dfae7007

Comment 4

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/bb91dfae7007