Bug 722028 - Need write barrier for SuppressDeletedPropertyHelper (r=bhackett)

2012-02-10 18:32:18 -08:00
parent bac34164ff
commit a1bc48033a
2 changed files with 19 additions and 0 deletions
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -1029,6 +1029,12 @@ SuppressDeletedPropertyHelper(JSContext *cx, JSObject *obj, StringPredicate pred
                        for (HeapPtr<JSFlatString> *p = idp; p + 1 != props_end; p++)
                            *p = *(p + 1);
                        ni->props_end = ni->end() - 1;
+
+                        /*
+                         * Invoke the write barrier on this element, since it's
+                         * no longer going to be marked.
+                         */
+                        ni->props_end->HeapPtr<JSFlatString>::~HeapPtr<JSFlatString>();
                    }

                    /* Don't reuse modified native iterators. */