Bug 1360961 - Assert that dying objects are not passed into the JSAPI r=sfink
authorJon Coppeard <jcoppeard@mozilla.com>
Thu, 04 May 2017 08:17:39 +0100
changeset 356611 bb4b18910a1bbab19d851a3a9740c4db61ad64e6
parent 356610 f0c85b49e72284f73c22dd2e9c65e2d563453bb0
child 356612 2aac093eff951f0f1353059347c4984e520bab7e
push id31768
push usercbook@mozilla.com
push dateFri, 05 May 2017 13:17:50 +0000
treeherdermozilla-central@9348b76977e8 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssfink
bugs1360961
milestone55.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1360961 - Assert that dying objects are not passed into the JSAPI r=sfink
js/src/jscntxtinlines.h
js/src/jsfun.cpp
--- a/js/src/jscntxtinlines.h
+++ b/js/src/jscntxtinlines.h
@@ -63,19 +63,21 @@ class CompartmentChecker
     }
 
     void checkZone(JS::Zone* z) {
         if (compartment && z != compartment->zone())
             fail(compartment->zone(), z);
     }
 
     void check(JSObject* obj) {
-        MOZ_ASSERT(JS::ObjectIsNotGray(obj));
-        if (obj)
+        if (obj) {
+            MOZ_ASSERT(JS::ObjectIsNotGray(obj));
+            MOZ_ASSERT(!js::gc::IsAboutToBeFinalizedUnbarriered(&obj));
             check(obj->compartment());
+        }
     }
 
     template<typename T>
     void check(const Rooted<T>& rooted) {
         check(rooted.get());
     }
 
     template<typename T>
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -727,16 +727,19 @@ js::fun_symbolHasInstance(JSContext* cx,
 }
 
 /*
  * ES6 (4-25-16) 7.3.19 OrdinaryHasInstance
  */
 bool
 JS::OrdinaryHasInstance(JSContext* cx, HandleObject objArg, HandleValue v, bool* bp)
 {
+    AssertHeapIsIdle();
+    assertSameCompartment(cx, objArg, v);
+
     RootedObject obj(cx, objArg);
 
     /* Step 1. */
     if (!obj->isCallable()) {
         *bp = false;
         return true;
     }