Closed Bug 833340 Opened 7 years ago Closed 7 years ago
Fix a couple of jittests failing with rooting analysis
Currently I see the following jittests failing with rooting analysis turned on: /home/jon/work/dev/tree/js/src/jit-test/tests/auto-regress/bug599464.js /home/jon/work/dev/tree/js/src/jit-test/tests/auto-regress/bug600128.js /home/jon/work/dev/tree/js/src/jit-test/tests/auto-regress/bug607502.js /home/jon/work/dev/tree/js/src/jit-test/tests/auto-regress/bug607513.js /home/jon/work/dev/tree/js/src/jit-test/tests/auto-regress/bug638212.js /home/jon/work/dev/tree/js/src/jit-test/tests/basic/bug698584.js /home/jon/work/dev/tree/js/src/jit-test/tests/basic/testBug507425.js /home/jon/work/dev/tree/js/src/jit-test/tests/basic/testOverRecursed4.js /home/jon/work/dev/tree/js/src/jit-test/tests/ion/bug827821-2.js
Comment on attachment 704884 [details] [diff] [review] Proposed fix All jittests pass with the above patch. The change to ConcatStringsMaybeAllowGC could perhaps be clearer, but I didn't immediately see a way to do this.
Comment on attachment 704884 [details] [diff] [review] Proposed fix Review of attachment 704884 [details] [diff] [review]: ----------------------------------------------------------------- Excellent! ::: js/src/jsscope.cpp @@ +1054,5 @@ > * initialized length and capacity of the object to zero and ensure that no > * new dense elements can be added without calling growElements(), which > * checks isExtensible(). > */ > + if (self->isNative() && !JSObject::sparsifyDenseElements(cx, self)) Ah, this is bug 830586. Please resolve it duplicate to this bug. ::: js/src/vm/String.cpp @@ +314,5 @@ > return left; > > size_t wholeLength = leftLen + rightLen; > + JSContext *cxIfCanGC = allowGC ? cx : NULL; > + if (!JSString::validateLength(cxIfCanGC, wholeLength)) Thanks, that's way better. Please also change the name of validateLength's |cx| argument to |maybecx|.
Attachment #704884 - Flags: review?(terrence) → review+
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla21
You need to log in before you can comment on or make changes to this bug.