Closed Bug 874105 Opened 7 years ago Closed 7 years ago

Make CallSetup hold a Rooted to the passed-in object

Categories

(Core :: DOM: Core & HTML, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla24

People

(Reporter: bzbarsky, Assigned: bzbarsky)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

Right now CallSetup calls UnmarkGray on the passed-in object, but if we then gc while someone is using that object and while the CallSetup is on the stack, the object can go gray again.

We should just hold a Rooted to the object in the CallSetup so we don't have to worry about that stuff.
Assignee: nobody → bzbarsky
Comment on attachment 751767 [details] [diff] [review]
Make CallSetup hold a Rooted to the object it's constructed with so we don't have to worry about it going gray while things like argument conversion for the call are in progress.

Review of attachment 751767 [details] [diff] [review]:
-----------------------------------------------------------------

good catch
Attachment #751767 - Flags: review?(continuation) → review+
Flags: in-testsuite-
Target Milestone: --- → mozilla24
https://hg.mozilla.org/mozilla-central/rev/d3052c10db7b
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.