Closed Bug 983029 Opened 9 years ago Closed 9 years ago

A union containing "object" fails to follow stack discipline for Rooted

Categories

(Core :: DOM: Core & HTML, defect)

x86
macOS
defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla30

People

(Reporter: bzbarsky, Assigned: bzbarsky)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

The generated code looks like this:

    if (args[0].isObject()) {
      JS::Rooted<JSObject*> argObj(cx, &args[0].toObject());
      arg0_holder.SetToObject(cx, argObj);
      done = true;
    } else {

where arg0_holder.SetToObject() ends up constructing a Maybe<Rooted<JSObject*>>.  Then argObj goes out of scope, and we end up with fatal asserts.
Assignee: nobody → bzbarsky
Status: NEW → ASSIGNED
https://hg.mozilla.org/integration/mozilla-inbound/rev/f9790cf27463
Flags: in-testsuite?
Whiteboard: [need review]
https://hg.mozilla.org/mozilla-central/rev/f9790cf27463
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.