Closed Bug 1454940 Opened 6 years ago Closed 6 years ago

Fix gray marking assertions related to transplanting

Categories

(Core :: JavaScript: GC, enhancement)

enhancement
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla61
Tracking Status
firefox61 --- fixed

People

(Reporter: jonco, Assigned: jonco)

References

Details

Attachments

(1 file)

I hit assertions about entering the compartment of a gray object in JS_TransplantObject when testing the browser with GC zeal.

As far as I can work out the "origobj" argument to this function can legitimately be gray as we don't create any references to it and expect it to be unused after we return.
Patch to allow 'origobj' to be gray while asserting that 'target' and the return value are not.
Attachment #8968880 - Flags: review?(sphink)
Comment on attachment 8968880 [details] [diff] [review]
bug1454940-transplant-assertions

Review of attachment 8968880 [details] [diff] [review]:
-----------------------------------------------------------------

wfm
Attachment #8968880 - Flags: review?(sphink) → review+
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/677b77419dcb
Update assertions in JS_TransplantObject to allow the original object to be gray r=sfink
https://hg.mozilla.org/mozilla-central/rev/677b77419dcb
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
Depends on: 1521717
You need to log in before you can comment on or make changes to this bug.