Last Comment Bug 721642 - js/src/jsproxy.cpp's proxy_TraceObject need not handle function proxies
: js/src/jsproxy.cpp's proxy_TraceObject need not handle function proxies
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
: -- normal (vote)
: mozilla13
Assigned To: Jim Blandy :jimb
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-01-26 23:18 PST by Jim Blandy :jimb
Modified: 2012-03-02 06:25 PST (History)
3 users (show)
jimb: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Remove function proxy support from proxy_TraceObject. (1.21 KB, patch)
2012-01-26 23:18 PST, Jim Blandy :jimb
jorendorff: review+
Details | Diff | Review

Description Jim Blandy :jimb 2012-01-26 23:18:50 PST
Created attachment 592067 [details] [diff] [review]
Remove function proxy support from proxy_TraceObject.

There's no need for proxy_TraceObject to handle both object and function proxies.

Function proxies will always call proxy_TraceFunction, which takes care of marking the 'call' and 'construct' slots.

The attached patch also moves the call to proxy_TraceObject from proxy_TraceFunction into a tail position, so it could be compiled as a jump.
Comment 1 Jim Blandy :jimb 2012-01-26 23:25:19 PST
try: https://tbpl.mozilla.org/?tree=Try&rev=5760242d704a
Comment 2 Andreas Gal :gal 2012-01-26 23:34:38 PST
Really? I thought for cloned functions we use JSObject-sized allocations (might have changed in the meantime).
Comment 3 Mozilla RelEng Bot 2012-01-27 03:00:24 PST
Try run for 5760242d704a is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=5760242d704a
Results (out of 207 total builds):
    success: 184
    warnings: 23
Builds (or logs if builds failed) available at:
http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/jblandy@mozilla.com-5760242d704a
Comment 4 Jim Blandy :jimb 2012-01-30 22:07:04 PST
(In reply to Andreas Gal :gal from comment #2)
> Really? I thought for cloned functions we use JSObject-sized allocations
> (might have changed in the meantime).

I'm not sure what you mean. The question is, how will proxy_TraceObject ever be called to trace an object that has "call" and "construct" slots? I don't see how cloned functions come into the picture.
Comment 5 Jason Orendorff [:jorendorff] 2012-02-27 10:56:53 PST
Comment on attachment 592067 [details] [diff] [review]
Remove function proxy support from proxy_TraceObject.

The patch looks correct to me.
Comment 6 Jim Blandy :jimb 2012-02-29 18:38:07 PST
Fresh try run: https://tbpl.mozilla.org/?tree=Try&rev=31b17181105a
Comment 7 Mozilla RelEng Bot 2012-02-29 22:46:18 PST
Try run for 31b17181105a is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=31b17181105a
Results (out of 216 total builds):
    exception: 1
    success: 176
    warnings: 37
    failure: 2
Builds (or logs if builds failed) available at:
http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/jblandy@mozilla.com-31b17181105a
Comment 8 Jim Blandy :jimb 2012-03-01 13:02:39 PST
I didn't see anything that didn't look like an infrastructure exception or a known intermittent bug, so I've pushed this.
https://hg.mozilla.org/integration/mozilla-inbound/rev/c22135099e70
Comment 9 Marco Bonardo [::mak] 2012-03-02 06:25:32 PST
https://hg.mozilla.org/mozilla-central/rev/c22135099e70

Note You need to log in before you can comment on or make changes to this bug.