Loading
Commits on Source 4
-
wasm::Realm::instances_ is a weak list. Readers rely on the instances()[i]->object() read barrier, but that barrier is a no-op once the owning zone is being incrementally swept, and entries are otherwise only removed at Instance finalization (~Instance -> unregisterInstance). So between marking a zone's instance objects dead and finalizing them, the list could still hand an about-to-be-finalized instance to a reader. Prune such entries at the start of zone sweeping via a new wasm::Realm::traceWeakInstances(), called from beginSweepingSweepGroup alongside the other per-realm weak-collection sweeps. This makes instances_ behave like the engine's other weak collections, so it never exposes an about-to-be-finalized instance to the mutator during sweep slices. Differential Revision: https://phabricator.services.mozilla.com/D314032
-
Bug 2053578 - Use static_cast in nsSplittableFrame::UpdateFirstContinuationAndFirstInFlowCache(). r=layout-reviewers,jfkthame `nsSplittableFrame` is a subclass of `nsIFrame`, it is sufficient to use `static_cast`. Differential Revision: https://phabricator.services.mozilla.com/D315157
-
Bug 2053578 - Update first-in-flow cache when a continuation is changing from fluid to non-fluid. r=layout-reviewers,jfkthame The original case in bug 2053578 comment 5 can reproduce an ASAN use-after-poison with the patch bug 2053578 comment 6 applied. However, with unpatched code, the best we can do is using a DEBUG-only assertion to catch the error condition that detect a stale first-in-flow cache in next-in-flow. `bidi-inline-continuation-first-in-flow.html` is generated with the help of Claude code, and it can trigger the assertion without other fix in this patch. Differential Revision: https://phabricator.services.mozilla.com/D315158
-
Bug 2058626: Check for mutually exclusive flags when deserializing cloned RegExp r=spidermonkey-reviewers,jonco Differential Revision: https://phabricator.services.mozilla.com/D316904