Closed
Bug 1616277
Opened 4 years ago
Closed 4 years ago
WeakRefMap::sweep unintentionally changes weak ref map data while sweeping
Categories
(Core :: JavaScript: GC, defect, P1)
Core
JavaScript: GC
Tracking
()
RESOLVED
FIXED
mozilla75
| Tracking | Status | |
|---|---|---|
| firefox75 | --- | fixed |
People
(Reporter: jonco, Assigned: jonco)
References
Details
Attachments
(1 file)
This doesn't matter too much because it only happens when the map entry is about to be removed, but WeakRefMap::sweep() uses a reference as the variable in the for loop that iterates over the vectors that are the map values, which means that we actually update the contents of the vector with the unwrapped objects in the following line.
This was causing assertions to fail when running the weak ref tests in the browser because we check that gray things are not assigned into HeapPtrs.
|
Assignee | |
Comment 1•4 years ago
|
||
Depends on D63188
Pushed by jcoppeard@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/b8bab151842e Avoid unintentially changing the contents of the weak ref map while sweeping r=sfink
|
||
Comment 3•4 years ago
|
||
| bugherder | ||
Status: NEW → RESOLVED
Closed: 4 years ago
status-firefox75:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla75
You need to log in
before you can comment on or make changes to this bug.
Description
•