Bug 1479430 - Make sure TypeNewScript::maybeAnalyze is called in the group's realm. r=luke
authorJan de Mooij <jdemooij@mozilla.com>
Thu, 16 Aug 2018 11:59:19 +0200
changeset 487682 8695f16b39ed48f002dccabf249da238bdb3e8b4
parent 487681 f2dc5d8ac9ac55899c14d7a031951ccef0bc720d
child 487683 bb155905368517d486de333676962091fb317e54
push id9719
push userffxbld-merge
push dateFri, 24 Aug 2018 17:49:46 +0000
treeherdermozilla-beta@719ec98fba77 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersluke
bugs1479430
milestone63.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1479430 - Make sure TypeNewScript::maybeAnalyze is called in the group's realm. r=luke
js/src/jit-test/tests/realms/bug1479430.js
js/src/jit/Ion.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/realms/bug1479430.js
@@ -0,0 +1,6 @@
+function f(a) {
+    return a.toString();
+}
+var g = newGlobal({sameCompartmentAs: this});
+g.evaluate("function Obj() {}");
+f(f(new g.Obj()));
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -2082,16 +2082,17 @@ IonCompile(JSContext* cx, JSScript* scri
         AbortReason reason = buildResult.unwrapErr();
         builder->graphSpewer().endFunction();
         if (reason == AbortReason::PreliminaryObjects) {
             // Some group was accessed which has associated preliminary objects
             // to analyze. Do this now and we will try to build again shortly.
             const MIRGenerator::ObjectGroupVector& groups = builder->abortedPreliminaryGroups();
             for (size_t i = 0; i < groups.length(); i++) {
                 ObjectGroup* group = groups[i];
+                AutoRealm ar(cx, group);
                 AutoSweepObjectGroup sweep(group);
                 if (auto* newScript = group->newScript(sweep)) {
                     if (!newScript->maybeAnalyze(cx, group, nullptr, /* force = */ true))
                         return AbortReason::Alloc;
                 } else if (auto* preliminaryObjects = group->maybePreliminaryObjects(sweep)) {
                     preliminaryObjects->maybeAnalyze(cx, group, /* force = */ true);
                 } else {
                     MOZ_CRASH("Unexpected aborted preliminary group");