Closed
Bug 983029
Opened 11 years ago
Closed 11 years ago
A union containing "object" fails to follow stack discipline for Rooted
Categories
(Core :: DOM: Core & HTML, defect)
Tracking
()
RESOLVED
FIXED
mozilla30
People
(Reporter: bzbarsky, Assigned: bzbarsky)
References
(Blocks 1 open bug)
Details
Attachments
(1 file)
The generated code looks like this:
if (args[0].isObject()) {
JS::Rooted<JSObject*> argObj(cx, &args[0].toObject());
arg0_holder.SetToObject(cx, argObj);
done = true;
} else {
where arg0_holder.SetToObject() ends up constructing a Maybe<Rooted<JSObject*>>. Then argObj goes out of scope, and we end up with fatal asserts.
|
Assignee | |
Comment 1•11 years ago
|
||
Attachment #8390320 -
Flags: review?(khuey)
|
|
Assignee | |
Updated•11 years ago
|
Assignee: nobody → bzbarsky
Status: NEW → ASSIGNED
Attachment #8390320 -
Flags: review?(khuey) → review+
|
|
Assignee | |
Comment 2•11 years ago
|
||
Flags: in-testsuite?
Whiteboard: [need review]
|
||
Comment 3•11 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
|
||
Updated•6 years ago
|
Component: DOM → DOM: Core & HTML
You need to log in
before you can comment on or make changes to this bug.
Description
•