Bug 1116306 r=sfink s=abillings

js/src/jit-test/tests/gc/bug1116306.js

@@ -0,0 +1,8 @@
+const dbg = new Debugger();
+const g = newGlobal();
+dbg.addDebuggee(g);
+dbg.memory.trackingAllocationSites = true;
+g.eval("this.alloc = {}");
+verifyprebarriers();
+schedulegc(3);
+dbg.memory.drainAllocationsLog();

js/src/vm/DebuggerMemory.cpp

@@ -197,8 +197,7 @@ DebuggerMemory::drainAllocationsLog(JSContext *cx, unsigned argc, Value *vp)
         if (!obj)
             return false;
 
-        mozilla::UniquePtr<Debugger::AllocationSite, JS::DeletePolicy<Debugger::AllocationSite> >
-            allocSite(dbg->allocationsLog.popFirst());
+        Debugger::AllocationSite *allocSite = dbg->allocationsLog.getFirst();
         RootedValue frame(cx, ObjectOrNullValue(allocSite->frame));
         if (!JSObject::defineProperty(cx, obj, cx->names().frame, frame))
             return false;
@@ -208,6 +207,9 @@ DebuggerMemory::drainAllocationsLog(JSContext *cx, unsigned argc, Value *vp)
             return false;
 
         result->setDenseElement(i, ObjectValue(*obj));
+
+        MOZ_ALWAYS_TRUE(dbg->allocationsLog.popFirst() == allocSite);
+        js_delete(allocSite);
     }
 
     dbg->allocationsLogLength = 0;