Hazard: Function 'void mozilla::dom::CallbackObject::CallSetup::CallSetup(mozilla::dom::CallbackObject*, mozilla::ErrorResult*, uint32, JSCompartment*)' has unrooted 'realCallback' of type 'JSObject*' live across GC call 'mozilla::dom::workers::WorkerGlobalScope* mozilla::dom::workers::WorkerPrivate::GlobalScope() const' at /home/sfink/src/MI-upstream/dom/bindings/CallbackObject.cpp:102

GlobalScope() shouldn't be able to GC, but we're already playing this trick a little later in this file.

Comment on attachment 8350821 [details] [diff] [review] Root CallbackObject's CallSetup around GlobalScope() call r=terrence via irc

landed in https://hg.mozilla.org/integration/mozilla-inbound/rev/f71e6905567f backed out in https://hg.mozilla.org/integration/mozilla-inbound/rev/e9d4787444d3 due to IsInRequest assertion

Requesting review from bholley because I don't know if I still need to unwrap, or if there's a more straightforward way.

This is pretty perf-sensitive code; refetching is very suboptimal.

Comment on attachment 8350851 [details] [diff] [review] Re-fetch realCallback after GC danger is past Yeah, we should try to do something smarter here.