From aec88a162c28b89e1d9d912b92419e1d10d730cf Mon Sep 17 00:00:00 2001 From: win7-7 Date: Wed, 12 Oct 2022 20:13:20 +0300 Subject: [PATCH] Somewhat 60 level of security. Somewhat 60 level of security. --- js/src/jit/CodeGenerator.cpp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp index acb408c419..2642ed06c0 100644 --- a/js/src/jit/CodeGenerator.cpp +++ b/js/src/jit/CodeGenerator.cpp @@ -9472,6 +9472,11 @@ CodeGenerator::linkSharedStubs(JSContext* cx) bool CodeGenerator::link(JSContext* cx, CompilerConstraintList* constraints) { + // We cancel off-thread Ion compilations in a few places during GC, but if + // this compilation was performed off-thread it will already have been + // removed from the relevant lists by this point. Don't allow GC here. + JS::AutoAssertNoGC nogc(cx); + RootedScript script(cx, gen->info().script()); OptimizationLevel optimizationLevel = gen->optimizationInfo().level(); @@ -9546,7 +9551,7 @@ CodeGenerator::link(JSContext* cx, CompilerConstraintList* constraints) // read barriers which were skipped while compiling the script off thread. Linker linker(masm); AutoFlushICache afc("IonLink"); - JitCode* code = linker.newCode(cx, ION_CODE, !patchableBackedges_.empty()); + JitCode* code = linker.newCode(cx, ION_CODE, !patchableBackedges_.empty()); if (!code) return false;