Long-awaited fix courtesy rogerl's keen analysis (19165, r=rogerl@netscape.com).
git-svn-id: svn://10.0.0.236/trunk@58217 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
@@ -204,7 +204,7 @@ JS_ArenaRelease(JSArenaPool *pool, char *mark)
|
||||
JSArena *a;
|
||||
|
||||
for (a = pool->first.next; a; a = a->next) {
|
||||
if (JS_UPTRDIFF(mark, a) < JS_UPTRDIFF(a->avail, a)) {
|
||||
if (JS_UPTRDIFF(mark, a->base) < JS_UPTRDIFF(a->avail, a->base)) {
|
||||
a->avail = (jsuword)JS_ARENA_ALIGN(pool, mark);
|
||||
FreeArenaList(pool, a, JS_TRUE);
|
||||
return;
|
||||
|
||||
@@ -152,7 +152,7 @@ struct JSArenaPool {
|
||||
JS_BEGIN_MACRO \
|
||||
char *_m = (char *)(mark); \
|
||||
JSArena *_a = (pool)->current; \
|
||||
if (JS_UPTRDIFF(_m, _a) <= JS_UPTRDIFF(_a->avail, _a)) { \
|
||||
if (JS_UPTRDIFF(_m, _a->base) <= JS_UPTRDIFF(_a->avail, _a->base)) { \
|
||||
_a->avail = (jsuword)JS_ARENA_ALIGN(pool, _m); \
|
||||
JS_CLEAR_UNUSED(_a); \
|
||||
JS_ArenaCountRetract(pool, _m); \
|
||||
|
||||
Reference in New Issue
Block a user