From 6e2fe86403bd2591027b616bbb46ee279f8186ed Mon Sep 17 00:00:00 2001 From: Jon Coppeard Date: Fri, 2 Aug 2013 13:15:39 +0100 Subject: [PATCH] Bug 899687 - crash in (anonymous namespace)::Worker::Trace(JSTracer*, JSObject*) r=khuey --- dom/workers/Worker.cpp | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/dom/workers/Worker.cpp b/dom/workers/Worker.cpp index 54e84503a74a..ddc990ad8877 100644 --- a/dom/workers/Worker.cpp +++ b/dom/workers/Worker.cpp @@ -142,13 +142,14 @@ protected: return false; } + // Ensure that the DOM_OBJECT_SLOT always has a PrivateValue set, as this + // will be accessed in the Trace() method if WorkerPrivate::Create() + // triggers a GC. + js::SetReservedSlot(obj, DOM_OBJECT_SLOT, JS::PrivateValue(nullptr)); + nsRefPtr worker = WorkerPrivate::Create(aCx, obj, parent, scriptURL, aIsChromeWorker); if (!worker) { - // It'd be better if we could avoid allocating the JSObject until after we - // make sure we have a WorkerPrivate, but failing that we should at least - // make sure that the DOM_OBJECT_SLOT always has a PrivateValue. - js::SetReservedSlot(obj, DOM_OBJECT_SLOT, JS::PrivateValue(nullptr)); return false; }