983029 - A union containing "object" fails to follow stack discipline for Rooted

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Boris Zbarsky [:bzbarsky]]

The generated code looks like this:

    if (args[0].isObject()) {
      JS::Rooted<JSObject*> argObj(cx, &args[0].toObject());
      arg0_holder.SetToObject(cx, argObj);
      done = true;
    } else {

where arg0_holder.SetToObject() ends up constructing a Maybe<Rooted<JSObject*>>.  Then argObj goes out of scope, and we end up with fatal asserts.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Make sure to observe stack discipline for Rooted when initializing a WebIDL union containing the 'object' type.

Comment 2

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f9790cf27463

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/f9790cf27463