Bug 1321597 - ubi::Node::exposeToJS() needs a barrier r=fitzgen
authorJon Coppeard <jcoppeard@mozilla.com>
Fri, 20 Jan 2017 12:09:06 +0000
changeset 375341 63c9d5f388ee125184fcdb0c1b506ab432a77867
parent 375340 8b510027eae07a61a61e80177bc327653cfe6b0b
child 375342 c077b729fc6076505fef8f3909653ebc550a086f
push id6996
push userjlorenzo@mozilla.com
push dateMon, 06 Mar 2017 20:48:21 +0000
treeherdermozilla-beta@d89512dab048 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersfitzgen
bugs1321597
milestone53.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1321597 - ubi::Node::exposeToJS() needs a barrier r=fitzgen
js/src/jit-test/tests/gc/bug-1321597.js
js/src/vm/UbiNode.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1321597.js
@@ -0,0 +1,6 @@
+gczeal(9,3);
+function test(s, okLine) {  };
+var dbg = new Debugger;
+dbg.onNewGlobalObject = function(global) {};
+x = evalcx(test());
+shortestPaths(this, ["\$4"], 5);
--- a/js/src/vm/UbiNode.cpp
+++ b/js/src/vm/UbiNode.cpp
@@ -202,16 +202,18 @@ Node::exposeToJS() const
     } else if (is<JSString>()) {
         v.setString(as<JSString>());
     } else if (is<JS::Symbol>()) {
         v.setSymbol(as<JS::Symbol>());
     } else {
         v.setUndefined();
     }
 
+    ExposeValueToActiveJS(v);
+
     return v;
 }
 
 
 // A JS::CallbackTracer subclass that adds a Edge to a Vector for each
 // edge on which it is invoked.
 class EdgeVectorTracer : public JS::CallbackTracer {
     // The vector to which we add Edges.