diff options
| author | Moonchild <moonchild@palemoon.org> | 2020-07-10 18:46:10 +0000 |
|---|---|---|
| committer | Moonchild <moonchild@palemoon.org> | 2020-07-10 18:46:10 +0000 |
| commit | f1b51be787c11090c8d9b2ec73255df7a67c7eb7 (patch) | |
| tree | 9c6d35ce6f19e0fef3c47c7e2c152394854cf217 /js/src/vm/NativeObject.h | |
| parent | 2deaddfca28508ac1a634eb6088a1da8e571ec6e (diff) | |
| parent | 82faff19e1761797b7a75f9221f0709c5a38bfe6 (diff) | |
| download | UXP-f1b51be787c11090c8d9b2ec73255df7a67c7eb7.tar UXP-f1b51be787c11090c8d9b2ec73255df7a67c7eb7.tar.gz UXP-f1b51be787c11090c8d9b2ec73255df7a67c7eb7.tar.lz UXP-f1b51be787c11090c8d9b2ec73255df7a67c7eb7.tar.xz UXP-f1b51be787c11090c8d9b2ec73255df7a67c7eb7.zip | |
Merge branch 'redwood' into releaseRELBASE_20200711
Diffstat (limited to 'js/src/vm/NativeObject.h')
| -rw-r--r-- | js/src/vm/NativeObject.h | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/js/src/vm/NativeObject.h b/js/src/vm/NativeObject.h index 3a3e50244..e9c59ff7c 100644 --- a/js/src/vm/NativeObject.h +++ b/js/src/vm/NativeObject.h @@ -646,7 +646,10 @@ class NativeObject : public ShapedObject uint32_t slotSpan() const { if (inDictionaryMode()) return lastProperty()->base()->slotSpan(); - return lastProperty()->slotSpan(); + + // Get the class from the object group rather than the base shape to avoid a + // race between Shape::ensureOwnBaseShape and background sweeping. + return lastProperty()->slotSpan(getClass()); } /* Whether a slot is at a fixed offset from this object. */ |