Bug 1347984 - Add some more release asserts to promise job handling code. r=jandem, a=lizzard
☠☠ backed out by 2125aa846c90 ☠ ☠
authorTill Schneidereit <till@tillschneidereit.net>
Sat, 20 May 2017 15:20:53 +0200
changeset 394076 adb1f8ff7655660d862286c4949f6f606c8d0d77
parent 394075 6441d136fc1c0197a8d5f1a4c423b98b2a0d5351
child 394077 cd589e5aabd45c7785cf0970a01fa29cee6925f1
push id7356
push userryanvm@gmail.com
push dateThu, 25 May 2017 15:03:58 +0000
treeherdermozilla-beta@38c9c1ad194a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, lizzard
bugs1347984
milestone54.0
Bug 1347984 - Add some more release asserts to promise job handling code. r=jandem, a=lizzard MozReview-Commit-ID: BCzPvFYS8Ko
js/src/builtin/Promise.cpp
--- a/js/src/builtin/Promise.cpp
+++ b/js/src/builtin/Promise.cpp
@@ -804,18 +804,21 @@ TriggerPromiseReactions(JSContext* cx, H
 
     if (reactions->is<PromiseReactionRecord>() || IsWrapper(reactions))
         return EnqueuePromiseReactionJob(cx, reactions, valueOrReason, state);
 
     RootedNativeObject reactionsList(cx, &reactions->as<NativeObject>());
     size_t reactionsCount = reactionsList->getDenseInitializedLength();
     MOZ_ASSERT(reactionsCount > 1, "Reactions list should be created lazily");
 
+    RootedValue reactionVal(cx);
     for (size_t i = 0; i < reactionsCount; i++) {
-        reaction = &reactionsList->getDenseElement(i).toObject();
+        reactionVal = reactionsList->getDenseElement(i);
+        MOZ_RELEASE_ASSERT(reactionVal.isObject());
+        reaction = &reactionVal.toObject();
         if (!EnqueuePromiseReactionJob(cx, reaction, valueOrReason, state))
             return false;
     }
 
     return true;
 }
 
 static MOZ_MUST_USE bool
@@ -2443,16 +2446,17 @@ BlockOnPromise(JSContext* cx, HandleValu
     return AddPromiseReaction(cx, promise, UndefinedHandleValue, UndefinedHandleValue,
                               blockedPromise, nullptr, nullptr, nullptr);
 }
 
 static MOZ_MUST_USE bool
 AddPromiseReaction(JSContext* cx, Handle<PromiseObject*> promise,
                    Handle<PromiseReactionRecord*> reaction)
 {
+    MOZ_RELEASE_ASSERT(reaction->is<PromiseReactionRecord>());
     RootedValue reactionVal(cx, ObjectValue(*reaction));
 
     // The code that creates Promise reactions can handle wrapped Promises,
     // unwrapping them as needed. That means that the `promise` and `reaction`
     // objects we have here aren't necessarily from the same compartment. In
     // order to store the reaction on the promise, we have to ensure that it
     // is properly wrapped.
     mozilla::Maybe<AutoCompartment> ac;
@@ -2478,17 +2482,17 @@ AddPromiseReaction(JSContext* cx, Handle
     // list. In that case, `reactionsObj` might be a wrapper, which we can
     // always safely unwrap.
     if (IsProxy(reactionsObj)) {
         reactionsObj = UncheckedUnwrap(reactionsObj);
         if (JS_IsDeadWrapper(reactionsObj)) {
             JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_DEAD_OBJECT);
             return false;
         }
-        MOZ_ASSERT(reactionsObj->is<PromiseReactionRecord>());
+        MOZ_RELEASE_ASSERT(reactionsObj->is<PromiseReactionRecord>());
     }
 
     if (reactionsObj->is<PromiseReactionRecord>()) {
         // If a single reaction existed so far, create a list and store the
         // old and the new reaction in it.
         reactions = NewDenseFullyAllocatedArray(cx, 2);
         if (!reactions)
             return false;
@@ -2496,16 +2500,17 @@ AddPromiseReaction(JSContext* cx, Handle
             return false;
 
         reactions->setDenseElement(0, reactionsVal);
         reactions->setDenseElement(1, reactionVal);
 
         promise->setFixedSlot(PromiseSlot_ReactionsOrResult, ObjectValue(*reactions));
     } else {
         // Otherwise, just store the new reaction.
+        MOZ_RELEASE_ASSERT(reactionsObj->is<NativeObject>());
         reactions = &reactionsObj->as<NativeObject>();
         uint32_t len = reactions->getDenseInitializedLength();
         if (reactions->ensureDenseElements(cx, 0, len + 1) != DenseElementResult::Success)
             return false;
         reactions->setDenseElement(len, reactionVal);
     }
 
     return true;