Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-29 07:42:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1279618 - Don't touch the js::Class in JSObject::finalize() after having called the finalizer on it; r=jonco

Browse Source
This commit is contained in:
Ehsan Akhgari 2016-06-10 16:49:24 -04:00
parent 6d673a6148
commit 1db86caf2d
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
js/src/jsobjinlines.h
View File

@ -78,14 +78,15 @@ JSObject::finalize(js::FreeOp* fop)
#endif #endif
const js::Class* clasp = getClass(); const js::Class* clasp = getClass();
js::NativeObject* nobj = nullptr;
if (clasp->isNative())
nobj = &as<js::NativeObject>();
if (clasp->hasFinalize()) if (clasp->hasFinalize())
clasp->doFinalize(fop, this); clasp->doFinalize(fop, this);
if (!clasp->isNative()) if (!nobj)
return; return;
js::NativeObject* nobj = &as<js::NativeObject>();
if (nobj->hasDynamicSlots()) if (nobj->hasDynamicSlots())
fop->free_(nobj->slots_); fop->free_(nobj->slots_);