to grows, shrinks, and compresses. This helps JS_DHashTableOperate callers
who hold returned entry pointers to validate those pointers and avoid having
to re-lookup an entry by its key.
- Balance that addition by removing JSDHashTable.sizeMask, which is induced by
JSDHashTable.sizeLog2 at the cost of two typically single-cycle instructions.
- Use JSDHashTable.generation in jsobj.c to avoid unsafely dereferencing an
entry pointer held across calls to JSClass.resolve from js_LookupProperty,
which may recur and add entries to cx->resolving, growing that table and
invalidating entry pointers held by earlier js_LookupProperty activations.
(bug 78121, r=jst@netscape.com, sr=jband@netscape.com, a=asa@mozilla.org)
git-svn-id: svn://10.0.0.236/trunk@95896 18797224-902f-48f8-a5cc-f745e15eee43
bf20b1ca3d