Bug 1532599 - Force expected crashes on unexpected magic values. r=jandem a=RyanVM
authorNicolas B. Pierron <nicolas.b.pierron@nbp.name>
Wed, 06 Mar 2019 20:23:43 +0000
changeset 513429 5f4ba71d48892ddfc9e800aec521a46eaae175fd
parent 513428 27212b825dee1e9b147ad2975853145a485e620c
child 513430 858a6e5a240a47d2f8a9dc8d29bc512417f773ab
push id10845
push userarchaeopteryx@coole-files.de
push dateFri, 08 Mar 2019 09:22:23 +0000
treeherdermozilla-beta@5f4ba71d4889 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, RyanVM
bugs1532599
milestone66.0
Bug 1532599 - Force expected crashes on unexpected magic values. r=jandem a=RyanVM Differential Revision: https://phabricator.services.mozilla.com/D22120
js/public/Value.h
--- a/js/public/Value.h
+++ b/js/public/Value.h
@@ -650,18 +650,21 @@ union alignas(8) Value {
 
   bool isFalse() const {
     return asBits_ == bitsFromTagAndPayload(JSVAL_TAG_BOOLEAN, uint32_t(false));
   }
 
   bool isMagic() const { return toTag() == JSVAL_TAG_MAGIC; }
 
   bool isMagic(JSWhyMagic why) const {
-    MOZ_ASSERT_IF(isMagic(), s_.payload_.why_ == why);
-    return isMagic();
+    if (!isMagic()) {
+      return false;
+    }
+    MOZ_RELEASE_ASSERT(s_.payload_.why_ == why);
+    return true;
   }
 
   JS::TraceKind traceKind() const {
     MOZ_ASSERT(isGCThing());
     static_assert((JSVAL_TAG_STRING & 0x03) == size_t(JS::TraceKind::String),
                   "Value type tags must correspond with JS::TraceKinds.");
     static_assert((JSVAL_TAG_SYMBOL & 0x03) == size_t(JS::TraceKind::Symbol),
                   "Value type tags must correspond with JS::TraceKinds.");