Bug 690970, part 1: unmark gray read barrier for weak maps. r=billm

2013-01-08 10:36:51 -08:00
parent 59e843bcab
commit 3a589ddf81
3 changed files with 26 additions and 0 deletions
--- a/js/src/jsweakmap.cpp
+++ b/js/src/jsweakmap.cpp
@@ -209,6 +209,10 @@ WeakMap_get_impl(JSContext *cx, CallArgs args)

    if (ObjectValueMap *map = GetObjectMap(&args.thisv().toObject())) {
        if (ObjectValueMap::Ptr ptr = map->lookup(key)) {
+            // Read barrier to prevent an incorrectly gray value from escaping the
+            // weak map. See the comment before UnmarkGrayChildren in gc/Marking.cpp
+            ExposeValueToActiveJS(ptr->value.get());
+
            args.rval().set(ptr->value);
            return true;
        }