diff options
| author | Moonchild <moonchild@palemoon.org> | 2020-08-13 12:10:54 +0000 |
|---|---|---|
| committer | Moonchild <moonchild@palemoon.org> | 2020-08-13 12:10:54 +0000 |
| commit | 11285cd0d6ef7de80d22187b99376602ed547214 (patch) | |
| tree | 034c72eea2e7838b08abd00f37acf8e3c9e97949 /js/src/vm | |
| parent | e1e535c1c6372f95b4a14b6a00b6d6e7be400c3b (diff) | |
| parent | d3383327a749ddb5c0626146c6f83bdfa3ea9936 (diff) | |
| download | UXP-11285cd0d6ef7de80d22187b99376602ed547214.tar UXP-11285cd0d6ef7de80d22187b99376602ed547214.tar.gz UXP-11285cd0d6ef7de80d22187b99376602ed547214.tar.lz UXP-11285cd0d6ef7de80d22187b99376602ed547214.tar.xz UXP-11285cd0d6ef7de80d22187b99376602ed547214.zip | |
Merge branch 'master' into es-modules-work
Diffstat (limited to 'js/src/vm')
| -rw-r--r-- | js/src/vm/NativeObject.h | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/js/src/vm/NativeObject.h b/js/src/vm/NativeObject.h index 3a3e50244..e9c59ff7c 100644 --- a/js/src/vm/NativeObject.h +++ b/js/src/vm/NativeObject.h @@ -646,7 +646,10 @@ class NativeObject : public ShapedObject uint32_t slotSpan() const { if (inDictionaryMode()) return lastProperty()->base()->slotSpan(); - return lastProperty()->slotSpan(); + + // Get the class from the object group rather than the base shape to avoid a + // race between Shape::ensureOwnBaseShape and background sweeping. + return lastProperty()->slotSpan(getClass()); } /* Whether a slot is at a fixed offset from this object. */ |