зеркало из https://github.com/mozilla/gecko-dev.git
c7d4570648
The sNPObjWrappers table can contain entries for dead JSObjects that have not yet been finalised. We need to take care not to trigger mJSObj's read barrier for such entries since that will attempt to expose the object to JS and cause this assertion. The patch does this by calling unbarrieredGetPtr() which avoids the barrier. Note converting a TenuredHeap to bool and testing equality against a pointer don't trigger the barrier. |
||
---|---|---|
.. | ||
base | ||
ipc | ||
test |