Bug 1303015 - Update assertions now CCWs can be allocated in the nursery r=terrence
authorJon Coppeard <jcoppeard@mozilla.com>
Fri, 23 Sep 2016 13:17:42 +0100
changeset 315162 e15d82589f84255ef9e428ff2fafa2f7f3bade88
parent 315161 4720c5b3663c88c0b5fe8f9f3c114a1aaaaad418
child 315163 7c4c4312a8c639feb1be77c32e709625ce58ac1d
push id32563
push userihsiao@mozilla.com
push dateMon, 26 Sep 2016 11:18:33 +0000
treeherderautoland@eb840c87b5fd [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersterrence
bugs1303015
milestone52.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1303015 - Update assertions now CCWs can be allocated in the nursery r=terrence
js/src/jit-test/tests/gc/bug-1303015.js
js/src/proxy/CrossCompartmentWrapper.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1303015.js
@@ -0,0 +1,13 @@
+if (!('oomTest' in this))
+    quit();
+
+var x = ``.split();
+oomTest(function() {
+    var lfGlobal = newGlobal();
+    for (lfLocal in this) {
+        if (!(lfLocal in lfGlobal)) {
+                lfGlobal[lfLocal] = this[lfLocal];
+        }
+    }
+});
+
--- a/js/src/proxy/CrossCompartmentWrapper.cpp
+++ b/js/src/proxy/CrossCompartmentWrapper.cpp
@@ -468,17 +468,16 @@ js::IsCrossCompartmentWrapper(JSObject* 
 {
     return IsWrapper(obj) &&
            !!(Wrapper::wrapperHandler(obj)->flags() & Wrapper::CROSS_COMPARTMENT);
 }
 
 void
 js::NukeCrossCompartmentWrapper(JSContext* cx, JSObject* wrapper)
 {
-    MOZ_ASSERT(!IsInsideNursery(wrapper));
     MOZ_ASSERT(wrapper->is<CrossCompartmentWrapperObject>());
 
     NotifyGCNukeWrapper(wrapper);
 
     wrapper->as<ProxyObject>().nuke(&DeadObjectProxy::singleton);
 
     MOZ_ASSERT(IsDeadProxyObject(wrapper));
 }