Commit a30794f5 authored by Bill McCloskey's avatar Bill McCloskey
Browse files

Bug 708805 - Add write barrier to JSFunction::env (r=bhackett)

parent e61b9ac0

js/src/jit-test/tests/basic/bug708805.js

0 → 100644
+4 −0
Original line number Diff line number Diff line 
gczeal(4);

test();

function test()

eval("with({}) let(x=[])(function(){#2=x})()");

js/src/jsfun.cpp

+1 −1
Original line number Diff line number Diff line
@@ -2163,7 +2163,7 @@ js_NewFunction(JSContext *cx, JSObject *funobj, Native native, uintN nargs, 
    if ((flags & JSFUN_KINDMASK) >= JSFUN_INTERPRETED) {

        JS_ASSERT(!native);

        fun->script().init(NULL);

        fun->setEnvironment(parent);

        fun->initEnvironment(parent);

    } else {

        fun->u.n.clasp = NULL;

        fun->u.n.native = native;

js/src/jsfun.h

+5 −3
Original line number Diff line number Diff line
@@ -116,8 +116,9 @@ struct JSFunction : public JSObject 
        } n;

        struct Scripted {

            JSScript    *script_; /* interpreted bytecode descriptor or null;

                                     use the setter! */

            JSObject    *env;     /* environment for new activations */

                                     use the accessor! */

            JSObject    *env_;    /* environment for new activations;

                                     use the accessor! */

        } i;

        void            *nativeOrScript;

    } u;
@@ -167,8 +168,9 @@ struct JSFunction : public JSObject 
     */

    inline JSObject *environment() const;

    inline void setEnvironment(JSObject *obj);

    inline void initEnvironment(JSObject *obj);



    static inline size_t offsetOfEnvironment() { return offsetof(JSFunction, u.i.env); }

    static inline size_t offsetOfEnvironment() { return offsetof(JSFunction, u.i.env_); }



    inline void setJoinable();

js/src/jsfuninlines.h

+9 −2
Original line number Diff line number Diff line
@@ -55,14 +55,21 @@ inline JSObject * 
JSFunction::environment() const

{

    JS_ASSERT(isInterpreted());

    return u.i.env;

    return u.i.env_;

}



inline void

JSFunction::setEnvironment(JSObject *obj)

{

    JS_ASSERT(isInterpreted());

    u.i.env = obj;

    *(js::HeapPtrObject *)&u.i.env_ = obj;

}



inline void

JSFunction::initEnvironment(JSObject *obj)

{

    JS_ASSERT(isInterpreted());

    ((js::HeapPtrObject *)&u.i.env_)->init(obj);

}



inline void