We do FastGetGlobalJSObject, but this doesn't unmark gray....

Pushed by bzbarsky@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/aa02a3d17d12 Ensure that we don't return gray objects when getting child windows by name or index. r=bholley

Comment on attachment 8776825 [details] [diff] [review] Ensure that we don't return gray objects when getting child windows by name or index Approval Request Comment [Feature/regressing bug #]: Incremental CC, found by the assertions in bug 1283634. [User impact if declined]: Intermittent crashes. [Describe test coverage new/current, TreeHerder]: It's been on TH for a week and no longer hits the assertions. [Risks and why]: There was a slow trickle of hard-to-exploit UAF crashes in previous branches caused by missing ExposeToActiveJS barriers in a few places. We added an assertion that catches these in bug 1283634. We'd like to uplift the fixes to Aurora to solve the crashes 6 weeks earlier than we otherwise might. The impact is relatively low, but the patches are also extremely simple and low risk. Aurora seems like the right balance here. [String/UUID change made/needed]: None.

Comment on attachment 8776825 [details] [diff] [review] Ensure that we don't return gray objects when getting child windows by name or index Crash fix, has stabilized on Nightly for a few weeks, Aurora50+