Bug 1321597 - ubi::Node::exposeToJS() needs a barrier r=fitzgen
authorJon Coppeard <jcoppeard@mozilla.com>
Fri, 20 Jan 2017 12:09:06 +0000
changeset 358365 63c9d5f388ee125184fcdb0c1b506ab432a77867
parent 358364 8b510027eae07a61a61e80177bc327653cfe6b0b
child 358366 c077b729fc6076505fef8f3909653ebc550a086f
push id10621
push userjlund@mozilla.com
push dateMon, 23 Jan 2017 16:02:43 +0000
treeherdermozilla-aurora@dca7b42e6c67 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersfitzgen
bugs1321597
milestone53.0a1
Bug 1321597 - ubi::Node::exposeToJS() needs a barrier r=fitzgen
js/src/jit-test/tests/gc/bug-1321597.js
js/src/vm/UbiNode.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1321597.js
@@ -0,0 +1,6 @@
+gczeal(9,3);
+function test(s, okLine) {  };
+var dbg = new Debugger;
+dbg.onNewGlobalObject = function(global) {};
+x = evalcx(test());
+shortestPaths(this, ["\$4"], 5);
--- a/js/src/vm/UbiNode.cpp
+++ b/js/src/vm/UbiNode.cpp
@@ -202,16 +202,18 @@ Node::exposeToJS() const
     } else if (is<JSString>()) {
         v.setString(as<JSString>());
     } else if (is<JS::Symbol>()) {
         v.setSymbol(as<JS::Symbol>());
     } else {
         v.setUndefined();
     }
 
+    ExposeValueToActiveJS(v);
+
     return v;
 }
 
 
 // A JS::CallbackTracer subclass that adds a Edge to a Vector for each
 // edge on which it is invoked.
 class EdgeVectorTracer : public JS::CallbackTracer {
     // The vector to which we add Edges.