Closed Bug 343290 Opened 13 years ago Closed 13 years ago
Missing root in JS
_New Property Iterator
There is a missing root in JS_NewPropertyIterator. In the general case (where we're dealing with a native object), there is a newborn root, and no calls to functions that can cause GC to happen to protect our new object. In the non-native case, however, we have a call to JS_Enumerate, which could allocate new objects and cause GC, destroying our newborn object.
Status: NEW → ASSIGNED
Priority: -- → P3
Attachment #227770 - Flags: review?(brendan) → review+
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
This should go on both 1.8 and 1.8.0, right? not just 1.8.0? nominating
Flags: blocking1.8.1? → blocking1.8.1+
Attachment #227770 - Flags: approval1.8.1?
This landed on the 1.8 branch with JS1.7.
Attachment #227770 - Flags: approval1.8.1? → approval18.104.22.168?
Comment on attachment 227770 [details] [diff] [review] Fix approved for 1.8.0 branch, a=dveditz for drivers
Attachment #227770 - Flags: approval22.214.171.124? → approval126.96.36.199+
Flags: blocking188.8.131.52? → blocking184.108.40.206+
Fixed on the 1.8.0 branch.
You need to log in before you can comment on or make changes to this bug.