tor-browser

commit 65f9ca8c8d198a5cc0ff89b82337d6572e915ab7
parent 572aafc40ad0f14f65b051b5a83fcbae9cbbce68
Author: Jon Coppeard <jcoppeard@mozilla.com>
Date:   Mon, 22 Dec 2025 11:06:45 +0000

Bug 2007047 - Fix addMarkObservers infrastructure to update observed pointers on compacting GC r=jandem

This was an oversight in the previous patch. It only affects this test
infrastructure.

Differential Revision: https://phabricator.services.mozilla.com/D277190

Diffstat:
A
js/src/jit-test/tests/gc/bug-2007047.js
 | 
16
++++++++++++++++
M
js/src/shell/jsshell.h
 | 
8
+++++---

2 files changed, 21 insertions(+), 3 deletions(-)
diff --git a/js/src/jit-test/tests/gc/bug-2007047.js b/js/src/jit-test/tests/gc/bug-2007047.js
@@ -0,0 +1,16 @@
+const opt = (function() {
+    class RNG {
+        a = 11;
+        b = 22;
+        c;
+    }
+    let rng = new RNG();
+    function func() {return rng}
+    return func;
+})();
+
+BigInt64Array[0] = [1.1, 2.2, 3.3];
+let va;
+try { va = this.addMarkObservers(BigInt64Array); } catch (e) {}
+this.relazifyFunctions(this, this, va, this);
+gc();
diff --git a/js/src/shell/jsshell.h b/js/src/shell/jsshell.h
@@ -169,9 +169,11 @@ class NonShrinkingValueVector
  public:
   bool traceWeak(JSTracer* trc) {
     for (HeapPtr<Value>& value : *this) {
-      if (value.isGCThing() &&
-          value.toGCThing()->zoneFromAnyThread()->isGCSweeping()) {
-        TraceWeakEdge(trc, &value, "NonShrinkingValueVector element");
+      if (value.isGCThing()) {
+        Zone* zone = value.toGCThing()->zoneFromAnyThread();
+        if (zone->isGCSweeping() || zone->isGCCompacting()) {
+          TraceWeakEdge(trc, &value, "NonShrinkingValueVector element");
+        }
       }
     }
     return true;