From 2c95334e0e8e9061ca21729eaad6802dbf242a75 Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Tue, 30 May 2023 22:53:52 +0000
Subject: [PATCH] Bug 1832284 - Fix rooting hazard in JSObject::swap r=sfink
Reorder blocks to avoid possbile GC while |na| and |nb| are live.
Differential Revision: https://phabricator.services.mozilla.com/D177627
---
js/src/vm/JSObject.cpp | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/js/src/vm/JSObject.cpp b/js/src/vm/JSObject.cpp
index 07739f5f92105..b2d59b017c701 100644
--- a/js/src/vm/JSObject.cpp
+++ b/js/src/vm/JSObject.cpp
@@ -1375,6 +1375,16 @@ void JSObject::swap(JSContext* cx, HandleObject a, HandleObject b,
}
}
+ // Restore original unique IDs.
+ if ((aid || bid) && (na || nb)) {
+ if ((aid && !gc::SetOrUpdateUniqueId(cx, a, aid)) ||
+ (bid && !gc::SetOrUpdateUniqueId(cx, b, bid))) {
+ oomUnsafe.crash("Failed to set unique ID after swap");
+ }
+ }
+ MOZ_ASSERT_IF(aid, gc::GetUniqueIdInfallible(a) == aid);
+ MOZ_ASSERT_IF(bid, gc::GetUniqueIdInfallible(b) == bid);
+
// Preserve the IsUsedAsPrototype flag on the objects.
if (aIsUsedAsPrototype) {
if (!JSObject::setIsUsedAsPrototype(cx, a)) {
@@ -1387,16 +1397,6 @@ void JSObject::swap(JSContext* cx, HandleObject a, HandleObject b,
}
}
- // Restore original unique IDs.
- if ((aid || bid) && (na || nb)) {
- if ((aid && !gc::SetOrUpdateUniqueId(cx, a, aid)) ||
- (bid && !gc::SetOrUpdateUniqueId(cx, b, bid))) {
- oomUnsafe.crash("Failed to set unique ID after swap");
- }
- }
- MOZ_ASSERT_IF(aid, gc::GetUniqueIdInfallible(a) == aid);
- MOZ_ASSERT_IF(bid, gc::GetUniqueIdInfallible(b) == bid);
-
/*
* We need a write barrier here. If |a| was marked and |b| was not, then
* after the swap, |b|'s guts would never be marked. The write barrier
--
GitLab