Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-03-09 04:25:38 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 921454 - Match the background-finalize-ity of the DeadObjectProxy with that of origobj in js_TransplantObjectWithWrapper. r=jonco

Browse Source
This commit is contained in:
Bobby Holley 2013-10-04 13:29:36 +02:00
parent 4a8a8167bd
commit aef20e4335
3 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
js/src/jsapi.cpp
View File

@ -1282,7 +1282,11 @@ js_TransplantObjectWithWrapper(JSContext *cx,
// a new unreachable dummy object and swap it with the reflector.
// After the swap we have a possibly-live object that isn't dangerous,
// and a possibly-dangerous object that isn't live.
RootedObject reflectorGuts(cx, NewDeadProxyObject(cx, JS_GetGlobalForObject(cx, origobj)));
ProxyOptions options;
if (!IsBackgroundFinalized(origobj->tenuredGetAllocKind()))
options.setForceForegroundFinalization(true);
RootedObject reflectorGuts(cx, NewDeadProxyObject(cx, JS_GetGlobalForObject(cx, origobj),
options));
if (!reflectorGuts || !JSObject::swap(cx, origobj, reflectorGuts))
MOZ_CRASH();

5
js/src/jswrapper.cpp
View File

@ -837,10 +837,11 @@ DeadObjectProxy DeadObjectProxy::singleton;
const char DeadObjectProxy::sDeadObjectFamily = 0;
JSObject *
js::NewDeadProxyObject(JSContext *cx, JSObject *parent)
js::NewDeadProxyObject(JSContext *cx, JSObject *parent,
const ProxyOptions &options)
{
return NewProxyObject(cx, &DeadObjectProxy::singleton, JS::NullHandleValue,
NULL, parent);
NULL, parent, options);
}
bool

3
js/src/jswrapper.h
View File

@ -255,7 +255,8 @@ bool
IsDeadProxyObject(JSObject *obj);
JSObject *
NewDeadProxyObject(JSContext *cx, JSObject *parent);
NewDeadProxyObject(JSContext *cx, JSObject *parent,
const ProxyOptions &options = ProxyOptions());
void
NukeCrossCompartmentWrapper(JSContext *cx, JSObject *wrapper);