Bug 1522817 - Always expose returned target object of wrapper r=sfink a=pascalc DEVEDITION_67_0b16_BUILD2 DEVEDITION_67_0b16_RELEASE FENNEC_67_0b16_BUILD2 FENNEC_67_0b16_RELEASE FIREFOX_67_0b16_BUILD2 FIREFOX_67_0b16_RELEASE
authorJon Coppeard <jcoppeard@mozilla.com>
Mon, 29 Apr 2019 16:06:09 +0100
changeset 523470 bb9c48a4e71aa927d148b7e91dfda6417c507c13
parent 523469 cdf167f4186a12d4e5cf34655dfd201da159f0cd
child 523471 3f79f8d0572e48d5ffd89cf3088a96bca173469d
push id11212
push userrgurzau@mozilla.com
push dateThu, 02 May 2019 23:21:59 +0000
treeherdermozilla-beta@bb9c48a4e71a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssfink, pascalc
Bug 1522817 - Always expose returned target object of wrapper r=sfink a=pascalc The comment here talks about unmarking wrapper targets in case we're in incremental GC, but it does it conditially based on the color of the wrapper. We can't depend on that because a wrapper marked gray may eventually be marked black. Also, I don't think we should be touching gray wrappers anyway. Let's just always expose here. Differential Revision: https://phabricator.services.mozilla.com/D29211
--- a/js/src/proxy/Wrapper.cpp
+++ b/js/src/proxy/Wrapper.cpp
@@ -305,19 +305,17 @@ JSObject* Wrapper::wrappedObject(JSObjec
     if (!wrapper->runtimeFromMainThread()->gc.isIncrementalGCInProgress() &&
         wrapper->isMarkedBlack()) {
     // Unmark wrapper targets that should be black in case an incremental GC
     // hasn't marked them the correct color yet.
-    if (!wrapper->isMarkedGray()) {
-      JS::ExposeObjectToActiveJS(target);
-    }
+    JS::ExposeObjectToActiveJS(target);
   return target;
 JS_FRIEND_API JSObject* js::UncheckedUnwrapWithoutExpose(JSObject* wrapped) {
   while (true) {
     if (!wrapped->is<WrapperObject>() || MOZ_UNLIKELY(IsWindowProxy(wrapped))) {