Closed
Bug 1162413
Opened 10 years ago
Closed 10 years ago
Relazification can cause CloneFunctionObject to assert
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
DUPLICATE
of bug 1161968
People
(Reporter: shu, Unassigned)
Details
Attachments
(1 file)
|
955 bytes,
patch
|
jandem
:
review+
|
Details | Diff | Splinter Review |
There's a check in CloneFunctionObject that instantiates an AutoDelazify |if (!useSameScript && fun->isInterpretedLazy())|.
The problem is that a GC could cause |fun| to be relazified, so we need to instantiate the AutoDelazify whenever !useSameScript, regardless of fun->isInterpretedLazy.
|
Reporter | |
Comment 1•10 years ago
|
||
Attachment #8602563 -
Flags: review?(jdemooij)
|
|
Reporter | |
Updated•10 years ago
|
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → DUPLICATE
|
||
Comment 3•10 years ago
|
||
Comment on attachment 8602563 [details] [diff] [review]
AutoDelazify when not reusing the script in CloneFunctionObject.
Review of attachment 8602563 [details] [diff] [review]:
-----------------------------------------------------------------
Makes sense.
Attachment #8602563 -
Flags: review?(jdemooij) → review+
You need to log in
before you can comment on or make changes to this bug.
Description
•