summaryrefslogtreecommitdiffstats
path: root/js/src
diff options
context:
space:
mode:
authortrav90 <travawine@protonmail.ch>2018-04-07 12:24:30 -0500
committertrav90 <travawine@protonmail.ch>2018-04-07 13:11:38 -0500
commitbbd4001cb261cc54e2adf804ea7cbeb09078d7d9 (patch)
tree581523beea01c0b144051caebb6cb8a95539717a /js/src
parentd960419686462067cb5745dcd1ad264abe0b1485 (diff)
downloadUXP-bbd4001cb261cc54e2adf804ea7cbeb09078d7d9.tar
UXP-bbd4001cb261cc54e2adf804ea7cbeb09078d7d9.tar.gz
UXP-bbd4001cb261cc54e2adf804ea7cbeb09078d7d9.tar.lz
UXP-bbd4001cb261cc54e2adf804ea7cbeb09078d7d9.tar.xz
UXP-bbd4001cb261cc54e2adf804ea7cbeb09078d7d9.zip
Fix Value::isGCThing footgun, stop returning true for NullValue
Diffstat (limited to 'js/src')
-rw-r--r--js/src/builtin/TestingFunctions.cpp2
-rw-r--r--js/src/gc/Barrier.cpp2
-rw-r--r--js/src/gc/Barrier.h2
-rw-r--r--js/src/gc/Marking.cpp4
-rw-r--r--js/src/gc/Marking.h2
-rw-r--r--js/src/jit/CodeGenerator.cpp4
-rw-r--r--js/src/jit/JitFrames.cpp2
-rw-r--r--js/src/jit/Lowering.cpp2
-rw-r--r--js/src/jit/arm/MacroAssembler-arm.cpp12
-rw-r--r--js/src/jit/arm/MacroAssembler-arm.h16
-rw-r--r--js/src/jit/arm64/MacroAssembler-arm64.h8
-rw-r--r--js/src/jit/mips32/MacroAssembler-mips32.cpp4
-rw-r--r--js/src/jit/mips32/MacroAssembler-mips32.h4
-rw-r--r--js/src/jit/mips64/MacroAssembler-mips64.cpp2
-rw-r--r--js/src/jit/mips64/MacroAssembler-mips64.h6
-rw-r--r--js/src/jit/x64/MacroAssembler-x64.h8
-rw-r--r--js/src/jit/x86/MacroAssembler-x86.cpp4
-rw-r--r--js/src/jit/x86/MacroAssembler-x86.h12
-rw-r--r--js/src/jscompartmentinlines.h2
-rw-r--r--js/src/jsfriendapi.h2
-rw-r--r--js/src/jsfun.h2
-rw-r--r--js/src/jsscript.cpp2
-rw-r--r--js/src/vm/ProxyObject.cpp2
23 files changed, 53 insertions, 53 deletions
diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index acf449b7e..a14f9ba69 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -881,7 +881,7 @@ HasChild(JSContext* cx, unsigned argc, Value* vp)
RootedValue parent(cx, args.get(0));
RootedValue child(cx, args.get(1));
- if (!parent.isMarkable() || !child.isMarkable()) {
+ if (!parent.isGCThing() || !child.isGCThing()) {
args.rval().setBoolean(false);
return true;
}
diff --git a/js/src/gc/Barrier.cpp b/js/src/gc/Barrier.cpp
index f19f6f046..6dab8d25b 100644
--- a/js/src/gc/Barrier.cpp
+++ b/js/src/gc/Barrier.cpp
@@ -56,7 +56,7 @@ HeapSlot::preconditionForWriteBarrierPost(NativeObject* obj, Kind kind, uint32_t
bool isCorrectSlot = kind == Slot
? obj->getSlotAddressUnchecked(slot)->get() == target
: static_cast<HeapSlot*>(obj->getDenseElements() + slot)->get() == target;
- bool isBlackToGray = target.isMarkable() &&
+ bool isBlackToGray = target.isGCThing() &&
IsMarkedBlack(obj) && JS::GCThingIsMarkedGray(JS::GCCellPtr(target));
return isCorrectSlot && !isBlackToGray;
}
diff --git a/js/src/gc/Barrier.h b/js/src/gc/Barrier.h
index 950c96314..effc9233e 100644
--- a/js/src/gc/Barrier.h
+++ b/js/src/gc/Barrier.h
@@ -282,7 +282,7 @@ template <typename S> struct ReadBarrierFunctor : public VoidDefaultAdaptor<S> {
template <>
struct InternalBarrierMethods<Value>
{
- static bool isMarkable(const Value& v) { return v.isMarkable(); }
+ static bool isMarkable(const Value& v) { return v.isGCThing(); }
static bool isMarkableTaggedPointer(const Value& v) { return isMarkable(v); }
static void preBarrier(const Value& v) {
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index d9235f9ac..b2c105999 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -328,7 +328,7 @@ ShouldMarkCrossCompartment(JSTracer* trc, JSObject* src, Cell* cell)
static bool
ShouldMarkCrossCompartment(JSTracer* trc, JSObject* src, const Value& val)
{
- return val.isMarkable() && ShouldMarkCrossCompartment(trc, src, (Cell*)val.toGCThing());
+ return val.isGCThing() && ShouldMarkCrossCompartment(trc, src, val.toGCThing());
}
static void
@@ -1599,7 +1599,7 @@ ObjectDenseElementsMayBeMarkable(NativeObject* nobj)
if (!mayBeMarkable) {
const Value* elements = nobj->getDenseElementsAllowCopyOnWrite();
for (unsigned i = 0; i < nobj->getDenseInitializedLength(); i++)
- MOZ_ASSERT(!elements[i].isMarkable());
+ MOZ_ASSERT(!elements[i].isGCThing());
}
#endif
diff --git a/js/src/gc/Marking.h b/js/src/gc/Marking.h
index ec4c69a2f..73f63d804 100644
--- a/js/src/gc/Marking.h
+++ b/js/src/gc/Marking.h
@@ -404,7 +404,7 @@ IsAboutToBeFinalizedDuringSweep(TenuredCell& tenured);
inline Cell*
ToMarkable(const Value& v)
{
- if (v.isMarkable())
+ if (v.isGCThing())
return (Cell*)v.toGCThing();
return nullptr;
}
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index ccdc5fbfa..7b2f8214b 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -8526,8 +8526,8 @@ StoreUnboxedPointer(MacroAssembler& masm, T address, MIRType type, const LAlloca
masm.patchableCallPreBarrier(address, type);
if (value->isConstant()) {
Value v = value->toConstant()->toJSValue();
- if (v.isMarkable()) {
- masm.storePtr(ImmGCPtr(v.toMarkablePointer()), address);
+ if (v.isGCThing()) {
+ masm.storePtr(ImmGCPtr(v.toGCThing()), address);
} else {
MOZ_ASSERT(v.isNull());
masm.storePtr(ImmWord(0), address);
diff --git a/js/src/jit/JitFrames.cpp b/js/src/jit/JitFrames.cpp
index 966d952d3..f11f17225 100644
--- a/js/src/jit/JitFrames.cpp
+++ b/js/src/jit/JitFrames.cpp
@@ -2062,7 +2062,7 @@ SnapshotIterator::traceAllocation(JSTracer* trc)
return;
Value v = allocationValue(alloc, RM_AlwaysDefault);
- if (!v.isMarkable())
+ if (!v.isGCThing())
return;
Value copy = v;
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 7f28a9020..730697163 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -2687,7 +2687,7 @@ IsNonNurseryConstant(MDefinition* def)
if (!def->isConstant())
return false;
Value v = def->toConstant()->toJSValue();
- return !v.isMarkable() || !IsInsideNursery(v.toMarkablePointer());
+ return !v.isGCThing() || !IsInsideNursery(v.toGCThing());
}
void
diff --git a/js/src/jit/arm/MacroAssembler-arm.cpp b/js/src/jit/arm/MacroAssembler-arm.cpp
index c6e627db6..d40578514 100644
--- a/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/js/src/jit/arm/MacroAssembler-arm.cpp
@@ -3286,8 +3286,8 @@ void
MacroAssemblerARMCompat::moveValue(const Value& val, Register type, Register data)
{
ma_mov(Imm32(val.toNunboxTag()), type);
- if (val.isMarkable())
- ma_mov(ImmGCPtr(val.toMarkablePointer()), data);
+ if (val.isGCThing())
+ ma_mov(ImmGCPtr(val.toGCThing()), data);
else
ma_mov(Imm32(val.toNunboxPayload()), data);
}
@@ -3484,8 +3484,8 @@ MacroAssemblerARMCompat::storePayload(const Value& val, const BaseIndex& dest)
ScratchRegisterScope scratch(asMasm());
SecondScratchRegisterScope scratch2(asMasm());
- if (val.isMarkable())
- ma_mov(ImmGCPtr(val.toMarkablePointer()), scratch);
+ if (val.isGCThing())
+ ma_mov(ImmGCPtr(val.toGCThing()), scratch);
else
ma_mov(Imm32(val.toNunboxPayload()), scratch);
@@ -5314,8 +5314,8 @@ MacroAssembler::branchTestValue(Condition cond, const ValueOperand& lhs,
// equal, short circuit false (NotEqual).
ScratchRegisterScope scratch(*this);
- if (rhs.isMarkable())
- ma_cmp(lhs.payloadReg(), ImmGCPtr(rhs.toMarkablePointer()), scratch);
+ if (rhs.isGCThing())
+ ma_cmp(lhs.payloadReg(), ImmGCPtr(rhs.toGCThing()), scratch);
else
ma_cmp(lhs.payloadReg(), Imm32(rhs.toNunboxPayload()), scratch);
ma_cmp(lhs.typeReg(), Imm32(rhs.toNunboxTag()), scratch, Equal);
diff --git a/js/src/jit/arm/MacroAssembler-arm.h b/js/src/jit/arm/MacroAssembler-arm.h
index c011af3c3..c20a6c3e5 100644
--- a/js/src/jit/arm/MacroAssembler-arm.h
+++ b/js/src/jit/arm/MacroAssembler-arm.h
@@ -915,8 +915,8 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
ma_mov(Imm32(val.toNunboxTag()), scratch);
ma_str(scratch, ToType(dest), scratch2);
- if (val.isMarkable())
- ma_mov(ImmGCPtr(val.toMarkablePointer()), scratch);
+ if (val.isGCThing())
+ ma_mov(ImmGCPtr(val.toGCThing()), scratch);
else
ma_mov(Imm32(val.toNunboxPayload()), scratch);
ma_str(scratch, ToPayload(dest), scratch2);
@@ -944,15 +944,15 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
// Store the payload, marking if necessary.
if (payloadoffset < 4096 && payloadoffset > -4096) {
- if (val.isMarkable())
- ma_mov(ImmGCPtr(val.toMarkablePointer()), scratch2);
+ if (val.isGCThing())
+ ma_mov(ImmGCPtr(val.toGCThing()), scratch2);
else
ma_mov(Imm32(val.toNunboxPayload()), scratch2);
ma_str(scratch2, DTRAddr(scratch, DtrOffImm(payloadoffset)));
} else {
ma_add(Imm32(payloadoffset), scratch, scratch2);
- if (val.isMarkable())
- ma_mov(ImmGCPtr(val.toMarkablePointer()), scratch2);
+ if (val.isGCThing())
+ ma_mov(ImmGCPtr(val.toGCThing()), scratch2);
else
ma_mov(Imm32(val.toNunboxPayload()), scratch2);
ma_str(scratch2, DTRAddr(scratch, DtrOffImm(0)));
@@ -977,8 +977,8 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
void popValue(ValueOperand val);
void pushValue(const Value& val) {
push(Imm32(val.toNunboxTag()));
- if (val.isMarkable())
- push(ImmGCPtr(val.toMarkablePointer()));
+ if (val.isGCThing())
+ push(ImmGCPtr(val.toGCThing()));
else
push(Imm32(val.toNunboxPayload()));
}
diff --git a/js/src/jit/arm64/MacroAssembler-arm64.h b/js/src/jit/arm64/MacroAssembler-arm64.h
index b95831443..c21e2fd66 100644
--- a/js/src/jit/arm64/MacroAssembler-arm64.h
+++ b/js/src/jit/arm64/MacroAssembler-arm64.h
@@ -306,7 +306,7 @@ class MacroAssemblerCompat : public vixl::MacroAssembler
void pushValue(const Value& val) {
vixl::UseScratchRegisterScope temps(this);
const Register scratch = temps.AcquireX().asUnsized();
- if (val.isMarkable()) {
+ if (val.isGCThing()) {
BufferOffset load = movePatchablePtr(ImmPtr(val.bitsAsPunboxPointer()), scratch);
writeDataRelocation(val, load);
push(scratch);
@@ -349,7 +349,7 @@ class MacroAssemblerCompat : public vixl::MacroAssembler
}
}
void moveValue(const Value& val, Register dest) {
- if (val.isMarkable()) {
+ if (val.isGCThing()) {
BufferOffset load = movePatchablePtr(ImmPtr(val.bitsAsPunboxPointer()), dest);
writeDataRelocation(val, load);
} else {
@@ -1835,8 +1835,8 @@ class MacroAssemblerCompat : public vixl::MacroAssembler
dataRelocations_.writeUnsigned(load.getOffset());
}
void writeDataRelocation(const Value& val, BufferOffset load) {
- if (val.isMarkable()) {
- gc::Cell* cell = val.toMarkablePointer();
+ if (val.isGCThing()) {
+ gc::Cell* cell = val.toGCThing();
if (cell && gc::IsInsideNursery(cell))
embedsNurseryPointers_ = true;
dataRelocations_.writeUnsigned(load.getOffset());
diff --git a/js/src/jit/mips32/MacroAssembler-mips32.cpp b/js/src/jit/mips32/MacroAssembler-mips32.cpp
index 0d3e55e21..2b2fab92d 100644
--- a/js/src/jit/mips32/MacroAssembler-mips32.cpp
+++ b/js/src/jit/mips32/MacroAssembler-mips32.cpp
@@ -1527,8 +1527,8 @@ MacroAssemblerMIPSCompat::getType(const Value& val)
void
MacroAssemblerMIPSCompat::moveData(const Value& val, Register data)
{
- if (val.isMarkable())
- ma_li(data, ImmGCPtr(val.toMarkablePointer()));
+ if (val.isGCThing())
+ ma_li(data, ImmGCPtr(val.toGCThing()));
else
ma_li(data, Imm32(val.toNunboxPayload()));
}
diff --git a/js/src/jit/mips32/MacroAssembler-mips32.h b/js/src/jit/mips32/MacroAssembler-mips32.h
index 4c7618d08..adb626bb0 100644
--- a/js/src/jit/mips32/MacroAssembler-mips32.h
+++ b/js/src/jit/mips32/MacroAssembler-mips32.h
@@ -480,8 +480,8 @@ class MacroAssemblerMIPSCompat : public MacroAssemblerMIPS
void popValue(ValueOperand val);
void pushValue(const Value& val) {
push(Imm32(val.toNunboxTag()));
- if (val.isMarkable())
- push(ImmGCPtr(val.toMarkablePointer()));
+ if (val.isGCThing())
+ push(ImmGCPtr(val.toGCThing()));
else
push(Imm32(val.toNunboxPayload()));
}
diff --git a/js/src/jit/mips64/MacroAssembler-mips64.cpp b/js/src/jit/mips64/MacroAssembler-mips64.cpp
index 329fa83f8..f58184bca 100644
--- a/js/src/jit/mips64/MacroAssembler-mips64.cpp
+++ b/js/src/jit/mips64/MacroAssembler-mips64.cpp
@@ -1885,7 +1885,7 @@ MacroAssemblerMIPS64Compat::storeValue(JSValueType type, Register reg, Address d
void
MacroAssemblerMIPS64Compat::storeValue(const Value& val, Address dest)
{
- if (val.isMarkable()) {
+ if (val.isGCThing()) {
writeDataRelocation(val);
movWithPatch(ImmWord(val.asRawBits()), SecondScratchReg);
} else {
diff --git a/js/src/jit/mips64/MacroAssembler-mips64.h b/js/src/jit/mips64/MacroAssembler-mips64.h
index 4cff87236..bfe452974 100644
--- a/js/src/jit/mips64/MacroAssembler-mips64.h
+++ b/js/src/jit/mips64/MacroAssembler-mips64.h
@@ -221,8 +221,8 @@ class MacroAssemblerMIPS64Compat : public MacroAssemblerMIPS64
}
void writeDataRelocation(const Value& val) {
- if (val.isMarkable()) {
- gc::Cell* cell = val.toMarkablePointer();
+ if (val.isGCThing()) {
+ gc::Cell* cell = val.toGCThing();
if (cell && gc::IsInsideNursery(cell))
embedsNurseryPointers_ = true;
dataRelocations_.writeUnsigned(currentOffset());
@@ -498,7 +498,7 @@ class MacroAssemblerMIPS64Compat : public MacroAssemblerMIPS64
void pushValue(ValueOperand val);
void popValue(ValueOperand val);
void pushValue(const Value& val) {
- if (val.isMarkable()) {
+ if (val.isGCThing()) {
writeDataRelocation(val);
movWithPatch(ImmWord(val.asRawBits()), ScratchRegister);
push(ScratchRegister);
diff --git a/js/src/jit/x64/MacroAssembler-x64.h b/js/src/jit/x64/MacroAssembler-x64.h
index cb81bd7c1..be450767b 100644
--- a/js/src/jit/x64/MacroAssembler-x64.h
+++ b/js/src/jit/x64/MacroAssembler-x64.h
@@ -58,8 +58,8 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
// X64 helpers.
/////////////////////////////////////////////////////////////////
void writeDataRelocation(const Value& val) {
- if (val.isMarkable()) {
- gc::Cell* cell = val.toMarkablePointer();
+ if (val.isGCThing()) {
+ gc::Cell* cell = val.toGCThing();
if (cell && gc::IsInsideNursery(cell))
embedsNurseryPointers_ = true;
dataRelocations_.writeUnsigned(masm.currentOffset());
@@ -132,7 +132,7 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
template <typename T>
void storeValue(const Value& val, const T& dest) {
ScratchRegisterScope scratch(asMasm());
- if (val.isMarkable()) {
+ if (val.isGCThing()) {
movWithPatch(ImmWord(val.asRawBits()), scratch);
writeDataRelocation(val);
} else {
@@ -171,7 +171,7 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
pop(val.valueReg());
}
void pushValue(const Value& val) {
- if (val.isMarkable()) {
+ if (val.isGCThing()) {
ScratchRegisterScope scratch(asMasm());
movWithPatch(ImmWord(val.asRawBits()), scratch);
writeDataRelocation(val);
diff --git a/js/src/jit/x86/MacroAssembler-x86.cpp b/js/src/jit/x86/MacroAssembler-x86.cpp
index 754b29c2d..dc97b5b5b 100644
--- a/js/src/jit/x86/MacroAssembler-x86.cpp
+++ b/js/src/jit/x86/MacroAssembler-x86.cpp
@@ -499,8 +499,8 @@ MacroAssembler::branchTestValue(Condition cond, const ValueOperand& lhs,
const Value& rhs, Label* label)
{
MOZ_ASSERT(cond == Equal || cond == NotEqual);
- if (rhs.isMarkable())
- cmpPtr(lhs.payloadReg(), ImmGCPtr(rhs.toMarkablePointer()));
+ if (rhs.isGCThing())
+ cmpPtr(lhs.payloadReg(), ImmGCPtr(rhs.toGCThing()));
else
cmpPtr(lhs.payloadReg(), ImmWord(rhs.toNunboxPayload()));
diff --git a/js/src/jit/x86/MacroAssembler-x86.h b/js/src/jit/x86/MacroAssembler-x86.h
index 21cd63a0c..2b2507c77 100644
--- a/js/src/jit/x86/MacroAssembler-x86.h
+++ b/js/src/jit/x86/MacroAssembler-x86.h
@@ -94,8 +94,8 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
}
void moveValue(const Value& val, Register type, Register data) {
movl(Imm32(val.toNunboxTag()), type);
- if (val.isMarkable())
- movl(ImmGCPtr(val.toMarkablePointer()), data);
+ if (val.isGCThing())
+ movl(ImmGCPtr(val.toGCThing()), data);
else
movl(Imm32(val.toNunboxPayload()), data);
}
@@ -213,8 +213,8 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
}
void pushValue(const Value& val) {
push(Imm32(val.toNunboxTag()));
- if (val.isMarkable())
- push(ImmGCPtr(val.toMarkablePointer()));
+ if (val.isGCThing())
+ push(ImmGCPtr(val.toGCThing()));
else
push(Imm32(val.toNunboxPayload()));
}
@@ -235,8 +235,8 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
pop(dest.high);
}
void storePayload(const Value& val, Operand dest) {
- if (val.isMarkable())
- movl(ImmGCPtr(val.toMarkablePointer()), ToPayload(dest));
+ if (val.isGCThing())
+ movl(ImmGCPtr(val.toGCThing()), ToPayload(dest));
else
movl(Imm32(val.toNunboxPayload()), ToPayload(dest));
}
diff --git a/js/src/jscompartmentinlines.h b/js/src/jscompartmentinlines.h
index 08d315db0..6a54bc5a6 100644
--- a/js/src/jscompartmentinlines.h
+++ b/js/src/jscompartmentinlines.h
@@ -61,7 +61,7 @@ inline bool
JSCompartment::wrap(JSContext* cx, JS::MutableHandleValue vp)
{
/* Only GC things have to be wrapped or copied. */
- if (!vp.isMarkable())
+ if (!vp.isGCThing())
return true;
/*
diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
index b1c7cb0dc..722085549 100644
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -761,7 +761,7 @@ SetReservedSlot(JSObject* obj, size_t slot, const JS::Value& value)
{
MOZ_ASSERT(slot < JSCLASS_RESERVED_SLOTS(GetObjectClass(obj)));
shadow::Object* sobj = reinterpret_cast<shadow::Object*>(obj);
- if (sobj->slotRef(slot).isMarkable() || value.isMarkable())
+ if (sobj->slotRef(slot).isGCThing() || value.isGCThing())
SetReservedOrProxyPrivateSlotWithBarrier(obj, slot, value);
else
sobj->slotRef(slot) = value;
diff --git a/js/src/jsfun.h b/js/src/jsfun.h
index d45d112a5..7da831aa2 100644
--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -830,7 +830,7 @@ inline void
JSFunction::setExtendedSlot(size_t which, const js::Value& val)
{
MOZ_ASSERT(which < mozilla::ArrayLength(toExtended()->extendedSlots));
- MOZ_ASSERT_IF(js::IsMarkedBlack(this) && val.isMarkable(),
+ MOZ_ASSERT_IF(js::IsMarkedBlack(this) && val.isGCThing(),
!JS::GCThingIsMarkedGray(JS::GCCellPtr(val)));
toExtended()->extendedSlots[which] = val;
}
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index e86ceab3d..9f914943e 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -3309,7 +3309,7 @@ js::detail::CopyScript(JSContext* cx, HandleScript src, HandleScript dst,
GCPtrValue* vector = Rebase<GCPtrValue>(dst, src, src->consts()->vector);
dst->consts()->vector = vector;
for (unsigned i = 0; i < nconsts; ++i)
- MOZ_ASSERT_IF(vector[i].isMarkable(), vector[i].toString()->isAtom());
+ MOZ_ASSERT_IF(vector[i].isGCThing(), vector[i].toString()->isAtom());
}
if (nobjects != 0) {
GCPtrObject* vector = Rebase<GCPtrObject>(dst, src, src->objects()->vector);
diff --git a/js/src/vm/ProxyObject.cpp b/js/src/vm/ProxyObject.cpp
index 49ed5a624..69b4cd952 100644
--- a/js/src/vm/ProxyObject.cpp
+++ b/js/src/vm/ProxyObject.cpp
@@ -45,7 +45,7 @@ ProxyObject::New(JSContext* cx, const BaseProxyHandler* handler, HandleValue pri
// wrappee. Prefer to allocate in the nursery, when possible.
NewObjectKind newKind = NurseryAllocatedProxy;
if (options.singleton()) {
- MOZ_ASSERT(priv.isGCThing() && priv.toGCThing()->isTenured());
+ MOZ_ASSERT(priv.isNull() || (priv.isGCThing() && priv.toGCThing()->isTenured()));
newKind = SingletonObject;
} else if ((priv.isGCThing() && priv.toGCThing()->isTenured()) ||
!handler->canNurseryAllocate() ||