Closed
Bug 1454940
Opened 7 years ago
Closed 7 years ago
Fix gray marking assertions related to transplanting
Categories
(Core :: JavaScript: GC, enhancement)
Core
JavaScript: GC
Tracking
()
RESOLVED
FIXED
mozilla61
| Tracking | Status | |
|---|---|---|
| firefox61 | --- | fixed |
People
(Reporter: jonco, Assigned: jonco)
References
Details
Attachments
(1 file)
|
3.14 KB,
patch
|
sfink
:
review+
|
Details | Diff | Splinter Review |
I hit assertions about entering the compartment of a gray object in JS_TransplantObject when testing the browser with GC zeal.
As far as I can work out the "origobj" argument to this function can legitimately be gray as we don't create any references to it and expect it to be unused after we return.
|
Assignee | |
Comment 1•7 years ago
|
||
Patch to allow 'origobj' to be gray while asserting that 'target' and the return value are not.
Attachment #8968880 -
Flags: review?(sphink)
|
||
Comment 2•7 years ago
|
||
Comment on attachment 8968880 [details] [diff] [review]
bug1454940-transplant-assertions
Review of attachment 8968880 [details] [diff] [review]:
-----------------------------------------------------------------
wfm
Attachment #8968880 -
Flags: review?(sphink) → review+
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/677b77419dcb
Update assertions in JS_TransplantObject to allow the original object to be gray r=sfink
|
||
Comment 4•7 years ago
|
||
| bugherder | ||
Status: NEW → RESOLVED
Closed: 7 years ago
status-firefox61:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
You need to log in
before you can comment on or make changes to this bug.
Description
•