Bug 1485547 - Assert object in SlotsEdge::trace won't be in nursery. r=jonco
authorYoshi Huang <allstars.chh@mozilla.com>
Thu, 22 Nov 2018 14:49:10 +0100
changeset 504318 606abc9b203e38cd66f2498bf6c5eb98f39eeadf
parent 504317 a1cd697c733cd1fb28e585acee93d6cd8d3048bc
child 504319 8264fe75578f62fa4f14d48ec8ca86d109e8ddf5
child 504334 e31c568c2e3eda32d9d5d8d9aca1dab645ff01d5
push id10290
push userffxbld-merge
push dateMon, 03 Dec 2018 16:23:23 +0000
treeherdermozilla-beta@700bed2445e6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjonco
bugs1485547
milestone65.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1485547 - Assert object in SlotsEdge::trace won't be in nursery. r=jonco
js/src/gc/Marking.cpp
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -2821,19 +2821,17 @@ js::gc::StoreBuffer::SlotsEdge::trace(Te
     NativeObject* obj = object();
     MOZ_ASSERT(IsCellPointerValid(obj));
 
     // Beware JSObject::swap exchanging a native object for a non-native one.
     if (!obj->isNative()) {
         return;
     }
 
-    if (IsInsideNursery(obj)) {
-        return;
-    }
+    MOZ_ASSERT(!IsInsideNursery(obj), "obj shouldn't live in nursery.");
 
     if (kind() == ElementKind) {
         uint32_t initLen = obj->getDenseInitializedLength();
         uint32_t numShifted = obj->getElementsHeader()->numShiftedElements();
         uint32_t clampedStart = start_;
         clampedStart = numShifted < clampedStart ? clampedStart - numShifted : 0;
         clampedStart = Min(clampedStart, initLen);
         uint32_t clampedEnd = start_ + count_;