Bug 1306669 - Root an object that lives across ffi_call. r=jonco, a=ritu
authorTooru Fujisawa <arai_a@mac.com>
Tue, 18 Oct 2016 21:43:30 +0900
changeset 358414 a0c8270776dfadbc9c946c0c75bd947f8fb75a95
parent 358413 87144d91760806f3d9f8b66bf9ab7103b1a91281
child 358415 bcca478fadc01e2f47d38675de8555cb1ced584d
push id1324
push usermtabara@mozilla.com
push dateMon, 16 Jan 2017 13:07:44 +0000
treeherdermozilla-release@a01c49833940 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjonco, ritu
bugs1306669
milestone51.0a2
Bug 1306669 - Root an object that lives across ffi_call. r=jonco, a=ritu
js/src/ctypes/CTypes.cpp
--- a/js/src/ctypes/CTypes.cpp
+++ b/js/src/ctypes/CTypes.cpp
@@ -8457,17 +8457,17 @@ CDataFinalizer::Methods::Dispose(JSConte
 
   if (!p) {
     return EmptyFinalizerCallError(cx, "CDataFinalizer.prototype.dispose");
   }
 
   Value valType = JS_GetReservedSlot(obj, SLOT_DATAFINALIZER_VALTYPE);
   MOZ_ASSERT(valType.isObject());
 
-  JSObject* objCTypes = CType::GetGlobalCTypes(cx, &valType.toObject());
+  RootedObject objCTypes(cx, CType::GetGlobalCTypes(cx, &valType.toObject()));
   if (!objCTypes)
     return false;
 
   Value valCodePtrType = JS_GetReservedSlot(obj, SLOT_DATAFINALIZER_CODETYPE);
   MOZ_ASSERT(valCodePtrType.isObject());
   JSObject* objCodePtrType = &valCodePtrType.toObject();
 
   JSObject* objCodeType = PointerType::GetBaseType(objCodePtrType);