nagai/fune
3
0
Fork 0
forked from mirrors/gecko-dev
Code Pull requests Activity

Bug 1516958 - Weaken failing assertion that fails to account for nuked wrappers. r=jimb

Browse source 
In theory, nuking a debugger or debuggee compartment should sever all Debugger
connections, but it doesn't (bug 1084626). Therefore we must tolerate dead
objects in the allocation log.

Differential Revision: https://phabricator.services.mozilla.com/D19064

--HG--
extra : moz-landing-system : lando
This commit is contained in:
Jason Orendorff 2019-02-07 22:21:44 +00:00
parent 073d9c1031
commit d41a5ad075
2 changed files with 7 additions and 2 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

3
js/src/jit-test/tests/debug/bug1516958.js Normal file
View file

@ -0,0 +1,3 @@
(new (newGlobal({newCompartment:true}).Debugger)(this)).memory.trackingAllocationSites = true;
nukeAllCCWs();
new Date();

6
js/src/vm/Debugger.h
View file

@ -23,6 +23,7 @@
#include "js/HashTable.h" #include "js/HashTable.h"
#include "js/Utility.h" #include "js/Utility.h"
#include "js/Wrapper.h" #include "js/Wrapper.h"
#include "proxy/DeadObjectProxy.h"
#include "vm/GeneratorObject.h" #include "vm/GeneratorObject.h"
#include "vm/GlobalObject.h" #include "vm/GlobalObject.h"
#include "vm/JSContext.h" #include "vm/JSContext.h"
@ -418,8 +419,9 @@ class Debugger : private mozilla::LinkedListElement<Debugger> {
ctorName(ctorName), ctorName(ctorName),
size(size), size(size),
inNursery(inNursery) { inNursery(inNursery) {
MOZ_ASSERT_IF(frame, UncheckedUnwrap(frame)->is<SavedFrame>()); MOZ_ASSERT_IF(frame, UncheckedUnwrap(frame)->is<SavedFrame>() ||
}; IsDeadProxyObject(frame));
}
HeapPtr<JSObject*> frame; HeapPtr<JSObject*> frame;
mozilla::TimeStamp when; mozilla::TimeStamp when;