From edee6fab0d1774120eca1f343574a305c46359e9 Mon Sep 17 00:00:00 2001 From: trav90 Date: Sat, 7 Apr 2018 12:24:30 -0500 Subject: Fix Value::isGCThing footgun, stop returning true for NullValue --- js/src/jsfun.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'js/src/jsfun.h') diff --git a/js/src/jsfun.h b/js/src/jsfun.h index d45d112a5e..7da831aa2b 100644 --- a/js/src/jsfun.h +++ b/js/src/jsfun.h @@ -830,7 +830,7 @@ inline void JSFunction::setExtendedSlot(size_t which, const js::Value& val) { MOZ_ASSERT(which < mozilla::ArrayLength(toExtended()->extendedSlots)); - MOZ_ASSERT_IF(js::IsMarkedBlack(this) && val.isMarkable(), + MOZ_ASSERT_IF(js::IsMarkedBlack(this) && val.isGCThing(), !JS::GCThingIsMarkedGray(JS::GCCellPtr(val))); toExtended()->extendedSlots[which] = val; } -- cgit v1.2.3