From 3022060e329ee3256ca5a24a82914ccf697d651a Mon Sep 17 00:00:00 2001
From: Terrence Cole <terrence@mozilla.com>
Date: Fri, 20 Dec 2013 10:16:11 -0800
Subject: [PATCH] Bug 952551 - Fix an exact rooting hazard in Shape::dump;
 r=sfink

---
 js/src/jsgc.cpp           |  4 ----
 js/src/jspropertytree.cpp | 39 +++++----------------------------------
 js/src/jspropertytree.h   |  4 ----
 3 files changed, 5 insertions(+), 42 deletions(-)

diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 2087b4d39dac..3389402f2682 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -4160,10 +4160,6 @@ EndSweepPhase(JSRuntime *rt, JSGCInvocationKind gckind, bool lastGC)
         }
     }
 
-#ifdef DEBUG
-    PropertyTree::dumpShapes(rt);
-#endif
-
     {
         gcstats::AutoPhase ap(rt->gcStats, gcstats::PHASE_DESTROY);
 
diff --git a/js/src/jspropertytree.cpp b/js/src/jspropertytree.cpp
index 8e3b69492620..e491018bffe7 100644
--- a/js/src/jspropertytree.cpp
+++ b/js/src/jspropertytree.cpp
@@ -284,6 +284,9 @@ KidsPointer::checkConsistency(Shape *aKid) const
 void
 Shape::dump(JSContext *cx, FILE *fp) const
 {
+    /* This is only used from gdb, so allowing GC here would just be confusing. */
+    gc::AutoSuppressGC suppress(cx);
+
     jsid propid = this->propid();
 
     JS_ASSERT(!JSID_IS_VOID(propid));
@@ -296,8 +299,8 @@ Shape::dump(JSContext *cx, FILE *fp) const
             str = JSID_TO_ATOM(propid);
         } else {
             JS_ASSERT(JSID_IS_OBJECT(propid));
-            RootedValue v(cx, IdToValue(propid));
-            JSString *s = ToStringSlow<CanGC>(cx, v);
+            Value v = IdToValue(propid);
+            JSString *s = ToStringSlow<NoGC>(cx, v);
             fputs("object ", fp);
             str = s ? s->ensureLinear(cx) : nullptr;
         }
@@ -370,36 +373,4 @@ Shape::dumpSubtree(JSContext *cx, int level, FILE *fp) const
     }
 }
 
-void
-js::PropertyTree::dumpShapes(JSRuntime *rt)
-{
-    static bool init = false;
-    static FILE *dumpfp = nullptr;
-    if (!init) {
-        init = true;
-        const char *name = getenv("JS_DUMP_SHAPES_FILE");
-        if (!name)
-            return;
-        dumpfp = fopen(name, "a");
-    }
-
-    if (!dumpfp)
-        return;
-
-    fprintf(dumpfp, "rt->gcNumber = %lu", (unsigned long)rt->gcNumber);
-
-    for (gc::GCCompartmentsIter c(rt); !c.done(); c.next()) {
-        fprintf(dumpfp, "*** Compartment %p ***\n", (void *)c.get());
-
-        /*
-        typedef JSCompartment::EmptyShapeSet HS;
-        HS &h = c->emptyShapes;
-        for (HS::Range r = h.all(); !r.empty(); r.popFront()) {
-            Shape *empty = r.front();
-            empty->dumpSubtree(rt, 0, dumpfp);
-            putc('\n', dumpfp);
-        }
-        */
-    }
-}
 #endif
diff --git a/js/src/jspropertytree.h b/js/src/jspropertytree.h
index 6eebd55e43d0..f94f29ed7333 100644
--- a/js/src/jspropertytree.h
+++ b/js/src/jspropertytree.h
@@ -99,10 +99,6 @@ class PropertyTree
     Shape *newShape(ExclusiveContext *cx);
     Shape *getChild(ExclusiveContext *cx, Shape *parent, uint32_t nfixed, const StackShape &child);
     Shape *lookupChild(ThreadSafeContext *cx, Shape *parent, const StackShape &child);
-
-#ifdef DEBUG
-    static void dumpShapes(JSRuntime *rt);
-#endif
 };
 
 } /* namespace js */