From 04b5512ebbd5d092a4ddc3d17c9d25b299205a28 Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Thu, 13 Dec 2018 10:38:59 +0000
Subject: [PATCH] Bug 1513465 - Fix bug in weak map checking where values are
 atoms and we aren't collecting the atoms zone r=sfink

---
 js/src/gc/Verifier.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/js/src/gc/Verifier.cpp b/js/src/gc/Verifier.cpp
index a209e873e0ba..d99073027b42 100644
--- a/js/src/gc/Verifier.cpp
+++ b/js/src/gc/Verifier.cpp
@@ -765,6 +765,7 @@ static JSObject* MaybeGetDelegate(Cell* cell) {
 bool js::gc::CheckWeakMapEntryMarking(const WeakMapBase* map, Cell* key,
                                       Cell* value) {
   DebugOnly<Zone*> zone = map->zone();
+  MOZ_ASSERT(zone->isGCMarking());
 
   JSObject* object = map->memberOf;
   MOZ_ASSERT_IF(object, object->zone() == zone);
@@ -782,7 +783,8 @@ bool js::gc::CheckWeakMapEntryMarking(const WeakMapBase* map, Cell* key,
   CellColor mapColor = object ? GetCellColor(object) : CellColor::Gray;
 
   CellColor keyColor = GetCellColor(key);
-  CellColor valueColor = GetCellColor(value);
+  CellColor valueColor = valueZone->isGCMarking() ? GetCellColor(value)
+                                                  : CellColor::Black;
 
   if (valueColor < Min(mapColor, keyColor)) {
     fprintf(stderr, "WeakMap value is less marked than map and key\n");