On Mon, Jul 14, 2014 at 7:52 PM, Nicholas Nethercote <[email protected]> wrote: > > In all three cases ObjectImpl::setFlag() gets called, which calls onto > Shape::replaceLastProperty(), which ends up "replacing" the shape by > creating one that's very similar but has a different flag... but the > original shape remains in the tree. This sounds dangerous but I don't > know if it's a bug or not.
Actually, I guess it is safe because the relevant object will now point to the new shape, and any old objects will will point to the old shape, and if the old shape is dead it'll be GC'd soon enough. Nick _______________________________________________ dev-tech-js-engine-internals mailing list [email protected] https://lists.mozilla.org/listinfo/dev-tech-js-engine-internals
