As a security precaution, we have turned on the setting "Require API key authentication for API requests" for everyone. If this has broken something, please contact
Last Comment Bug 743868 - GC: fix barriers in SupressDeletedProperties
: GC: fix barriers in SupressDeletedProperties
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: 14 Branch
: All All
: -- normal (vote)
: mozilla14
Assigned To: Terrence Cole [:terrence]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: 673454
  Show dependency treegraph
Reported: 2012-04-09 16:55 PDT by Terrence Cole [:terrence]
Modified: 2012-04-12 10:26 PDT (History)
3 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

v0 (1.74 KB, patch)
2012-04-09 16:55 PDT, Terrence Cole [:terrence]
wmccloskey: review+
Details | Diff | Splinter Review

Description User image Terrence Cole [:terrence] 2012-04-09 16:55:43 PDT
Created attachment 613433 [details] [diff] [review]

Right now, we simply stop tracing through deleted properties. This causes us to delete things that are still in the write buffer. We need to, in addition, set the reference to NULL to ensure that the write buffer doesn't dereference these dead entries.
Comment 1 User image Bill McCloskey (:billm) 2012-04-11 14:46:38 PDT
Comment on attachment 613433 [details] [diff] [review]

Review of attachment 613433 [details] [diff] [review]:

::: js/src/jsiter.cpp
@@ +1051,5 @@
>                          ni->props_end = ni->end() - 1;
>                          /*
> +                         * This invokes the pre barrier on this element, since
> +                         * it's no longer going to be marked and ensures that

I think you want a comma between "marked" and "and".
Comment 2 User image Terrence Cole [:terrence] 2012-04-11 15:49:43 PDT
Comment 3 User image :Ms2ger (⌚ UTC+1/+2) 2012-04-12 10:26:22 PDT

Note You need to log in before you can comment on or make changes to this bug.