Closed
Bug 1454940
Opened 6 years ago
Closed 6 years ago
Fix gray marking assertions related to transplanting
Categories
(Core :: JavaScript: GC, enhancement)
Core
JavaScript: GC
Tracking
()
RESOLVED
FIXED
mozilla61
Tracking | Status | |
---|---|---|
firefox61 | --- | fixed |
People
(Reporter: jonco, Assigned: jonco)
References
Details
Attachments
(1 file)
3.14 KB,
patch
|
sfink
:
review+
|
Details | Diff | Splinter Review |
I hit assertions about entering the compartment of a gray object in JS_TransplantObject when testing the browser with GC zeal. As far as I can work out the "origobj" argument to this function can legitimately be gray as we don't create any references to it and expect it to be unused after we return.
Assignee | ||
Comment 1•6 years ago
|
||
Patch to allow 'origobj' to be gray while asserting that 'target' and the return value are not.
Attachment #8968880 -
Flags: review?(sphink)
Comment 2•6 years ago
|
||
Comment on attachment 8968880 [details] [diff] [review] bug1454940-transplant-assertions Review of attachment 8968880 [details] [diff] [review]: ----------------------------------------------------------------- wfm
Attachment #8968880 -
Flags: review?(sphink) → review+
Pushed by jcoppeard@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/677b77419dcb Update assertions in JS_TransplantObject to allow the original object to be gray r=sfink
Comment 4•6 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/677b77419dcb
Status: NEW → RESOLVED
Closed: 6 years ago
status-firefox61:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
You need to log in
before you can comment on or make changes to this bug.
Description
•