Back out 5f623a11c6cb (bug 713226), 1ed8ccf96402 (bug 721579), 32af27f89c49 (bug 722028), 1300d282fd22 (bug 716067), dc0f6ad7eff3 (bug 723313), 0d2ab3f2e9b9 (bug 723773) for talos crashes
This commit is contained in:
@@ -1029,12 +1029,6 @@ SuppressDeletedPropertyHelper(JSContext *cx, JSObject *obj, StringPredicate pred
|
||||
for (HeapPtr<JSFlatString> *p = idp; p + 1 != props_end; p++)
|
||||
*p = *(p + 1);
|
||||
ni->props_end = ni->end() - 1;
|
||||
|
||||
/*
|
||||
* Invoke the write barrier on this element, since it's
|
||||
* no longer going to be marked.
|
||||
*/
|
||||
ni->props_end->HeapPtr<JSFlatString>::~HeapPtr<JSFlatString>();
|
||||
}
|
||||
|
||||
/* Don't reuse modified native iterators. */
|
||||
@@ -1385,7 +1379,7 @@ MarkGenerator(JSTracer *trc, JSGenerator *gen)
|
||||
* this code and save someone an hour later.
|
||||
*/
|
||||
MarkStackRangeConservatively(trc, gen->floatingStack, fp->formalArgsEnd());
|
||||
fp->mark(trc);
|
||||
js_TraceStackFrame(trc, fp);
|
||||
MarkStackRangeConservatively(trc, fp->slots(), gen->regs.sp);
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user