Closed Bug 1162413 Opened 7 years ago Closed 7 years ago

Relazification can cause CloneFunctionObject to assert

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED DUPLICATE of bug 1161968

People

(Reporter: shu, Unassigned)

Details

Attachments

(1 file)

There's a check in CloneFunctionObject that instantiates an AutoDelazify |if (!useSameScript && fun->isInterpretedLazy())|.

The problem is that a GC could cause |fun| to be relazified, so we need to instantiate the AutoDelazify whenever !useSameScript, regardless of fun->isInterpretedLazy.
Blocks: 1161362
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1161968
No longer blocks: 1161362
Comment on attachment 8602563 [details] [diff] [review]
AutoDelazify when not reusing the script in CloneFunctionObject.

Review of attachment 8602563 [details] [diff] [review]:
-----------------------------------------------------------------

Makes sense.
Attachment #8602563 - Flags: review?(jdemooij) → review+
You need to log in before you can comment on or make changes to this bug.