corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1132171 - Fix race updating object elements pointer after moving GC r=terrence

Browse Source
This commit is contained in:
Jon Coppeard
2015-02-17 12:18:21 +00:00
parent 12c4106bfd
commit ca203ae83d
2 changed files with 11 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
js/src/jsobj.cpp
View File

@@ -2580,16 +2580,15 @@ js_InitClass(JSContext *cx, HandleObject obj, HandleObject protoProto_,
void
JSObject::fixupAfterMovingGC()
{
/*
* If this is a copy-on-write elements we may need to fix up both the
* elements' pointer back to the owner object, and the elements pointer
* itself if it points to inline elements in another object.
*/
if (is<NativeObject>() && as<NativeObject>().hasDynamicElements()) {
ObjectElements *header = as<NativeObject>().getElementsHeader();
if (header->isCopyOnWrite()) {
NativeObject *owner = MaybeForwarded(header->ownerObject().get());
as<NativeObject>().elements_ = owner->getElementsHeader()->elements();
// For copy-on-write objects that don't own their elements, fix up the
// elements pointer if it points to inline elements in the owning object.
if (is<NativeObject>()) {
NativeObject &obj = as<NativeObject>();
if (obj.denseElementsAreCopyOnWrite()) {
NativeObject *owner = MaybeForwarded(obj.getElementsHeader()->ownerObject().get());
if (owner != &obj && owner->hasFixedElements())
obj.elements_ = owner->getElementsHeader()->elements();
MOZ_ASSERT(!IsForwarded(obj.getElementsHeader()->ownerObject().get()));
}
}
}