Skip to content

context: Use Heap pointers for GC objects stored in vectors

Without JS::Heap wrappers for these pointers, the objects may be moved to another location by the garbage collector without the pointers being updated. I thought JS::GCVector took care of that, but it doesn't.

So, running the tests with JS_GC_ZEAL=2 (extra frequent garbage collections) would occasionally move the job queue objects, and cause a crash when subsequently draining the job queue.

This regressed starting with commit ad90c931, where we switched from using JS::PersistentRooted (which is not moved around during GC) to tracing the job queue vector.

Merge request reports