Bug 1513465 - Fix bug in weak map checking where values are atoms and we aren't collecting the atoms zone r=sfink
authorJon Coppeard <jcoppeard@mozilla.com>
Thu, 13 Dec 2018 10:38:59 +0000
changeset 450375 247e265373eb26566e94303fa42b1237b80295d9
parent 450374 e79c7b512fd6d5ada535da090ded8fa87b8f5f98
child 450376 aa7d7dcdb4e3edc3a5c364e109554b89e45cf643
push id110482
push userjcoppeard@mozilla.com
push dateThu, 13 Dec 2018 10:44:35 +0000
treeherdermozilla-inbound@247e265373eb [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssfink
bugs1513465
milestone66.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1513465 - Fix bug in weak map checking where values are atoms and we aren't collecting the atoms zone r=sfink
js/src/gc/Verifier.cpp
--- a/js/src/gc/Verifier.cpp
+++ b/js/src/gc/Verifier.cpp
@@ -760,16 +760,17 @@ static JSObject* MaybeGetDelegate(Cell* 
 
   JS::AutoSuppressGCAnalysis nogc; // Calling the delegate op cannot GC.
   return op(object);
 }
 
 bool js::gc::CheckWeakMapEntryMarking(const WeakMapBase* map, Cell* key,
                                       Cell* value) {
   DebugOnly<Zone*> zone = map->zone();
+  MOZ_ASSERT(zone->isGCMarking());
 
   JSObject* object = map->memberOf;
   MOZ_ASSERT_IF(object, object->zone() == zone);
 
   // Debugger weak maps can have keys in different zones.
   Zone* keyZone = GetCellZone(key);
   MOZ_ASSERT_IF(!map->allowKeysInOtherZones(),
                 keyZone == zone || keyZone->isAtomsZone());
@@ -777,17 +778,18 @@ bool js::gc::CheckWeakMapEntryMarking(co
   DebugOnly<Zone*> valueZone = GetCellZone(value);
   MOZ_ASSERT(valueZone == zone || valueZone->isAtomsZone());
 
   // We may not know the color of the map, but we know that it's
   // alive so it must at least be marked gray.
   CellColor mapColor = object ? GetCellColor(object) : CellColor::Gray;
 
   CellColor keyColor = GetCellColor(key);
-  CellColor valueColor = GetCellColor(value);
+  CellColor valueColor = valueZone->isGCMarking() ? GetCellColor(value)
+                                                  : CellColor::Black;
 
   if (valueColor < Min(mapColor, keyColor)) {
     fprintf(stderr, "WeakMap value is less marked than map and key\n");
     fprintf(stderr, "(map %p is %s, key %p is %s, value %p is %s)\n", map,
             CellColorName(mapColor), key, CellColorName(keyColor), value,
             CellColorName(valueColor));
     return false;
   }