From 40c9102d6daf6488f4a0c0ed6524f965d47df2e4 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Wed, 12 Jun 2024 20:04:44 +0200 Subject: [PATCH] [js gc] Suppress GC during JSObject::swap We already suppressed GC for part of this, but we may sweep before the pre-write barrier is established. The simplest and safest thing is to suppress GC for the whole method. --- js/src/jsobj.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp index 46f89e547e..788a35d5c9 100644 --- a/js/src/jsobj.cpp +++ b/js/src/jsobj.cpp @@ -1505,6 +1505,10 @@ JSObject::swap(JSContext* cx, HandleObject a, HandleObject b) if (!JSObject::getGroup(cx, b)) oomUnsafe.crash("JSObject::swap"); + // Don't allow a GC which may observe intermediate states or run before we + // execute all necessary barriers. + AutoSuppressGC suppress(cx); + /* * Neither object may be in the nursery, but ensure we update any embedded * nursery pointers in either object. @@ -1545,10 +1549,6 @@ JSObject::swap(JSContext* cx, HandleObject a, HandleObject b) a->fixDictionaryShapeAfterSwap(); b->fixDictionaryShapeAfterSwap(); } else { - // Avoid GC in here to avoid confusing the tracing code with our - // intermediate state. - AutoSuppressGC suppress(cx); - // When the objects have different sizes, they will have different // numbers of fixed slots before and after the swap, so the slots for // native objects will need to be rearranged.