874105 - Make CallSetup hold a Rooted to the passed-in object

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Boris Zbarsky [:bzbarsky]]

Right now CallSetup calls UnmarkGray on the passed-in object, but if we then gc while someone is using that object and while the CallSetup is on the stack, the object can go gray again.

We should just hold a Rooted to the object in the CallSetup so we don't have to worry about that stuff.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Make CallSetup hold a Rooted to the object it's constructed with so we don't have to worry about it going gray while things like argument conversion for the call are in progress.

Comment 2

[Andrew McCreight [:mccr8]]

Comment on attachment 751767 [details] [diff] [review]
Make CallSetup hold a Rooted to the object it's constructed with so we don't have to worry about it going gray while things like argument conversion for the call are in progress.

Review of attachment 751767 [details] [diff] [review]:
-----------------------------------------------------------------

good catch

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/d3052c10db7b