Hazard: Function 'bool js::frontend::ParseContext<ParseHandler>::define(js::frontend::TokenStream&, js::PropertyName*, js::frontend::ParseContext<ParseHandler>::Node, js::frontend::Definition::Kind) [with ParseHandler = js::frontend::FullParseHandler; js::frontend::ParseContext<ParseHandler>::Node = js::frontend::ParseNode*]' has unrooted 'name' of type 'js::PropertyName*' live across GC call 'uint8 js::frontend::UpvarCookie::set(js::frontend::TokenStream*, uint32, uint16)' at js/src/frontend/Parser.cpp:148 Unless there's some special rule about GCs not happening during parsing, this is a straightforward PropertyName* problem. Hm... come to think of it, is this supposed to be sometimes off-thread now, and so we shouldn't handlify or something? I've fallen behind in all of this recent thread craziness.

Comment on attachment 815648 [details] [diff] [review] Handlify ParseContext::define Review of attachment 815648 [details] [diff] [review]: ----------------------------------------------------------------- r=me