Bug 674441 - Fix bogus script owner assertion (r=dmandelin)
authorBill McCloskey <wmccloskey@mozilla.com>
Tue, 02 Aug 2011 10:18:30 -0700
changeset 73708 75cd7345fb19f5b182a48858607e242d51043e9c
parent 73707 d976a3aed628a5ee7b9ac8b3781d117ece44db6e
child 73710 8a54bd8aa5c88f9aa6cdacaa088ea90193361c67
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
reviewersdmandelin
bugs674441
milestone8.0a1
Bug 674441 - Fix bogus script owner assertion (r=dmandelin)
js/src/jsfun.cpp
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -1581,18 +1581,24 @@ js_XDRFunctionObject(JSXDRState *xdr, JS
     if (xdr->mode == JSXDR_DECODE) {
         fun->nargs = flagsword >> 16;
         JS_ASSERT((flagsword & JSFUN_KINDMASK) >= JSFUN_INTERPRETED);
         fun->flags = uint16(flagsword);
         fun->u.i.skipmin = uint16(firstword >> 2);
         fun->u.i.wrapper = JSPackedBool((firstword >> 1) & 1);
     }
 
-    if (!js_XDRScript(xdr, &fun->u.i.script))
+    /*
+     * Don't directly store into fun->u.i.script because we want this to happen
+     * at the same time as we set the script's owner.
+     */
+    JSScript *script = fun->u.i.script;
+    if (!js_XDRScript(xdr, &script))
         return false;
+    fun->u.i.script = script;
 
     if (xdr->mode == JSXDR_DECODE) {
         *objp = FUN_OBJECT(fun);
         fun->u.i.script->setOwnerObject(fun);
 #ifdef CHECK_SCRIPT_OWNER
         fun->script()->owner = NULL;
 #endif
         JS_ASSERT(fun->nargs == fun->script()->bindings.countArgs());