js: Unbarriered read while in weak ptr callback

Inside the weak pointer callback, we only need to compare the pointer to
nullptr. Since we don't actually use the pointer's location, no read
barrier is needed.

Previously this was not a problem, but SpiderMonkey 52 now asserts that
the heap is not active when exposing a pointer to active JS through a
read barrier, so the weak pointer callback will crash if we try to use a
read barrier.

https://bugzilla.gnome.org/show_bug.cgi?id=784196

1 files changed, 11 insertions, 1 deletions

diff --git a/gjs/jsapi-util-root.h b/gjs/jsapi-util-root.h
index 6c6462f4..33f748db 100644
--- a/gjs/jsapi-util-root.h
+++ b/gjs/jsapi-util-root.h
@@ -75,7 +75,7 @@ struct GjsHeapOperation<JSObject *> {
     update_after_gc(JS::Heap<JSObject *> *location)
     {
         JS_UpdateWeakPointerAfterGC(location);
-        return (*location == nullptr);
+        return (location->unbarrieredGet() == nullptr);
     }
 };
 
@@ -197,6 +197,16 @@ public:
     }
     inline bool operator!=(const T& other) const { return !(*this == other); }
 
+    /* We can access the pointer without a read barrier if the only thing we
+     * are doing with it is comparing it to nullptr. */
+    bool
+    operator==(std::nullptr_t) const
+    {
+        if (m_rooted)
+            return m_root->get() == nullptr;
+        return m_heap.unbarrieredGet() == nullptr;
+    }
+
     /* You can get a Handle<T> if the thing is rooted, so that you can use this
      * wrapper with stack rooting. However, you must not do this if the
      * JSContext can be destroyed while the Handle is live. */