Bug 1377056. Ensure that the objectMoved hook, if any, is called when tenuring a nursery-allocated proxy. r=jonco

MozReview-Commit-ID: E2YTrQh4XGU
This commit is contained in:
Boris Zbarsky 2017-06-29 16:02:42 -07:00
parent 5bd9b06ca0
commit 38f787eaa5

View File

@ -2985,6 +2985,8 @@ js::TenuringTracer::moveObjectToTenured(JSObject* dst, JSObject* src, AllocKind
// inline ProxyValueArray.
MOZ_ASSERT(src->as<ProxyObject>().usingInlineValueArray());
dst->as<ProxyObject>().setInlineValueArray();
if (JSObjectMovedOp op = dst->getClass()->extObjectMovedOp())
op(dst, src);
} else if (JSObjectMovedOp op = dst->getClass()->extObjectMovedOp()) {
op(dst, src);
} else if (src->getClass()->hasFinalize()) {