nagai/fune
3
0
Fork 0
forked from mirrors/gecko-dev
Code Pull requests Activity

Bug 1894025 - Throw error rather than asserting when newDependentString creates string in different heap than requested r=jonco

Browse source 
Differential Revision: https://phabricator.services.mozilla.com/D208958
This commit is contained in:
Steve Fink 2024-04-30 22:52:49 +00:00
parent 0749f6bcdf
commit 51448578a2
2 changed files with 23 additions and 4 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

12
js/src/builtin/TestingFunctions.cpp
View file

@ -3782,10 +3782,14 @@ static bool NewDependentString(JSContext* cx, unsigned argc, Value* vp) {
}
if (requiredHeap.isSome()) {
MOZ_ASSERT_IF(*requiredHeap == gc::Heap::Tenured, result->isTenured());
if ((*requiredHeap == gc::Heap::Default) && result->isTenured()) {
JS_ReportErrorASCII(cx, "nursery string created in tenured heap");
return false;
if ((*requiredHeap == gc::Heap::Tenured) != result->isTenured()) {
if (result->isTenured()) {
JS_ReportErrorASCII(cx, "nursery string created in tenured heap");
return false;
} else {
JS_ReportErrorASCII(cx, "tenured string created in nursery heap");
return false;
}
}
}

15
js/src/jit-test/tests/gc/bug-1894025.js Normal file
View file

@ -0,0 +1,15 @@
gczeal(0);
var ex;
function makeExtensibleStrFrom() {
strstrstr;
}
a = makeExtensibleStrFrom;
b = newDependentString(a, 0, 50, { tenured: false })
var exc;
try {
c = newDependentString(b, 0, { tenured: true })
} catch (e) {
exc = e;
}
assertEq(Boolean(exc), true, "b and c required to be in different heaps but are the same");