925585 - Missing Rooted in proxy_createFunction

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Steve Fink [:sfink] [:s:]]

Hazard:

Function 'jsproxy.cpp:uint8 proxy_createFunction(JSContext*, uint32, JS::Value*)' has unrooted 'construct' of type 'JSObject*' live across GC call 'JSObject* JS_NewObjectWithGivenProto(JSContext*, JSClass*, JSObject*, JSObject*)' at js/src/jsproxy.cpp:3267
    js/src/jsproxy.cpp:3266: Call(56,57, __temp_19 := Jsvalify(CallConstructHolder))
    js/src/jsproxy.cpp:3267: Call(57,58, __temp_21 := cx*.field:0.global())
    js/src/jsproxy.cpp:3267: Call(58,59, __temp_20 := __temp_21.operator 135())
    js/src/jsproxy.cpp:3267: Call(59,60, __temp_18 := JS_NewObjectWithGivenProto(cx*,__temp_19*,0,__temp_20**.field:0))
    js/src/jsproxy.cpp:3267: Call(60,61, __temp_22*.GuardObjectNotifier(0))
    js/src/jsproxy.cpp:3267: Call(61,62, ccHolder.Rooted(cx*,__temp_18*,__temp_22))
    js/src/jsproxy.cpp:3267: Call(62,63, __temp_22.~GuardObjectNotifier())
    js/src/jsproxy.cpp:3268: Call(63,64, __temp_23 := ccHolder.operator 168())
    js/src/jsproxy.cpp:3268: Assume(64,71, null(__temp_23**), false)
    js/src/jsproxy.cpp:3270: Call(71,72, __temp_24 := ccHolder.operator->())
    js/src/jsproxy.cpp:3270: Call(72,73, __temp_26 := call.operator 168())
    js/src/jsproxy.cpp:3270: Call(73,74, __temp_25 := ObjectValue(__temp_26**))
    js/src/jsproxy.cpp:3270: Call(74,75, __temp_24*.setReservedSlot(0,__temp_25))
    js/src/jsproxy.cpp:3271: Call(75,76, __temp_27 := ccHolder.operator->())
    js/src/jsproxy.cpp:3271: Call(76,77, __temp_28 := ObjectValue(construct*))

Looks like a straightforward missing root to me.

Comment 1

[Steve Fink [:sfink] [:s:]]

Attachment: Missing Rooted in proxy_createFunction

Comment 2

[Terrence Cole [:terrence]]

Comment on attachment 815654 [details] [diff] [review]
Missing Rooted in proxy_createFunction

Review of attachment 815654 [details] [diff] [review]:
-----------------------------------------------------------------

r=me

Comment 3

[Tom S [:evilpie]]

Typical style is to drop the nullptr.

Comment 4

[Steve Fink [:sfink] [:s:]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c82f469916b9

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/c82f469916b9