Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-22 02:09:28 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1336467 - Don't blacken weakmap key unless both the delegate and the map are black r=mccr8

Browse Source
This commit is contained in:
Jon Coppeard 2017-02-16 10:29:33 +00:00
parent 861ffe9744
commit 5dd6187a2c
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
xpcom/base/CycleCollectedJSContext.cpp
View File

@ -247,10 +247,10 @@ struct FixWeakMappingGrayBitsTracer : public js::WeakMapTracer
void trace(JSObject* aMap, JS::GCCellPtr aKey, JS::GCCellPtr aValue) override
{
// If nothing that could be held alive by this entry is marked gray, return.
bool delegateMightNeedMarking = aKey && JS::GCThingIsMarkedGray(aKey);
bool keyMightNeedMarking = aKey && JS::GCThingIsMarkedGray(aKey);
bool valueMightNeedMarking = aValue && JS::GCThingIsMarkedGray(aValue) &&
aValue.kind() != JS::TraceKind::String;
if (!delegateMightNeedMarking && !valueMightNeedMarking) {
if (!keyMightNeedMarking && !valueMightNeedMarking) {
return;
}
@ -258,9 +258,11 @@ struct FixWeakMappingGrayBitsTracer : public js::WeakMapTracer
aKey = nullptr;
}
if (delegateMightNeedMarking && aKey.is<JSObject>()) {
if (keyMightNeedMarking && aKey.is<JSObject>()) {
JSObject* kdelegate = js::GetWeakmapKeyDelegate(&aKey.as<JSObject>());
if (kdelegate && !JS::ObjectIsMarkedGray(kdelegate)) {
if (kdelegate && !JS::ObjectIsMarkedGray(kdelegate) &&
(!aMap || !JS::ObjectIsMarkedGray(aMap)))
{
if (JS::UnmarkGrayGCThingRecursively(aKey)) {
mAnyMarked = true;
}