Closed Bug 715201 Opened 8 years ago Closed 8 years ago

GC: missing barriers in BaseShape's new constructor

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla12

People

(Reporter: terrence, Assigned: terrence)

References

Details

Attachments

(1 file, 1 obsolete file)

Attached patch v1 (obsolete) — Splinter Review
BaseShape's new copy constructor for StackBaseShape needs to be write barriered
like the existing constructor.
Attachment #585805 - Flags: review?(bhackett1024)
Comment on attachment 585805 [details] [diff] [review]
v1

Review of attachment 585805 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsscopeinlines.h
@@ +104,5 @@
>      this->flags = base.flags;
>      this->rawGetter = base.rawGetter;
>      this->rawSetter = base.rawSetter;
> +    if ((base.flags & HAS_GETTER_OBJECT) && base.rawGetter) {
> +        this->flags |= HAS_GETTER_OBJECT;

This line is unnecessary.

@@ +108,5 @@
> +        this->flags |= HAS_GETTER_OBJECT;
> +        JSObject::writeBarrierPost(this->getterObj, &this->getterObj);
> +    }
> +    if ((base.flags & HAS_SETTER_OBJECT) && base.rawSetter) {
> +        this->flags |= HAS_SETTER_OBJECT;

Ditto.
Attachment #585805 - Flags: review?(bhackett1024) → review+
Ah, right, we've already assigned the full flags word, unlike with the other constructor.  Thanks for the review!
Attachment #585805 - Attachment is obsolete: true
Attachment #585903 - Flags: review+
https://hg.mozilla.org/mozilla-central/rev/bb91dfae7007
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla12
You need to log in before you can comment on or make changes to this bug.