816770 - [meta] GC: convert all bare gc-thing pointers to GC-safe wrappers

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Terrence Cole [:terrence]]

In adding type-safe, asserting wrappers to Shape and JSScript, I found and fixed 10's of fairly obvious rooting bugs that were not caught by the rooting analysis because they were on paths that are not well tested (but would be hit in practice on the web).  Given that the type-y-ness and new assertions are finding real bugs, I'd like to make exact rooting depend on us at least visiting each type and fixing the low-hanging fruit.

Since this work is going to touch (in a light way) a fairly large percentage of the lines in SpiderMonkey, I'm opening this [meta] bug to act as a tracking bug for smaller pieces of work.

Comment 1

[Terrence Cole [:terrence]]

Thankfully, the static analysis makes this large chunk of work wholly unnecessary.