summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMoonchild <moonchild@palemoon.org>2020-07-10 16:15:00 +0000
committerMoonchild <moonchild@palemoon.org>2020-07-10 16:15:00 +0000
commitf0a6ca4f95a017c1697a8b696fad07e305940e1f (patch)
tree106503f34b241ddb25b2bd882ddfaddaeb9ba929
parent5d700cd91355634916a27c8a609234d2385210f9 (diff)
downloadUXP-f0a6ca4f95a017c1697a8b696fad07e305940e1f.tar
UXP-f0a6ca4f95a017c1697a8b696fad07e305940e1f.tar.gz
UXP-f0a6ca4f95a017c1697a8b696fad07e305940e1f.tar.lz
UXP-f0a6ca4f95a017c1697a8b696fad07e305940e1f.tar.xz
UXP-f0a6ca4f95a017c1697a8b696fad07e305940e1f.zip
[js] Get the class pointer from the ObjectGroup in NativeObject::slotSpan
This changes NativeObject::slotSpan() to get the class from the object group rather than getting it from the base shape to avoid a race between Shape::ensureOwnBaseShape and background sweeping.
-rw-r--r--js/src/vm/NativeObject.h5
1 files changed, 4 insertions, 1 deletions
diff --git a/js/src/vm/NativeObject.h b/js/src/vm/NativeObject.h
index 3a3e50244..e9c59ff7c 100644
--- a/js/src/vm/NativeObject.h
+++ b/js/src/vm/NativeObject.h
@@ -646,7 +646,10 @@ class NativeObject : public ShapedObject
uint32_t slotSpan() const {
if (inDictionaryMode())
return lastProperty()->base()->slotSpan();
- return lastProperty()->slotSpan();
+
+ // Get the class from the object group rather than the base shape to avoid a
+ // race between Shape::ensureOwnBaseShape and background sweeping.
+ return lastProperty()->slotSpan(getClass());
}
/* Whether a slot is at a fixed offset from this object. */