bf20b1ca3d
to grows, shrinks, and compresses. This helps JS_DHashTableOperate callers who hold returned entry pointers to validate those pointers and avoid having to re-lookup an entry by its key. - Balance that addition by removing JSDHashTable.sizeMask, which is induced by JSDHashTable.sizeLog2 at the cost of two typically single-cycle instructions. - Use JSDHashTable.generation in jsobj.c to avoid unsafely dereferencing an entry pointer held across calls to JSClass.resolve from js_LookupProperty, which may recur and add entries to cx->resolving, growing that table and invalidating entry pointers held by earlier js_LookupProperty activations. (bug 78121, r=jst@netscape.com, sr=jband@netscape.com, a=asa@mozilla.org) git-svn-id: svn://10.0.0.236/trunk@95896 18797224-902f-48f8-a5cc-f745e15eee43