Bug 815542 - crash in IncrementalCollectSlice r=billm

--HG--
extra : rebase_source : d751b3684f6461b094278aa39508417928c2b660

js/xpconnect/src/XPCJSRuntime.cpp

@@ -830,6 +830,8 @@ XPCJSRuntime::FinalizeCallback(JSFreeOp *fop, JSFinalizeStatus status, JSBool is
             // Find dying scopes.
             XPCWrappedNativeScope::StartFinalizationPhaseOfGC(fop, self);
 
+            XPCStringConvert::ClearCache();
+
             self->mDoingFinalization = true;
             break;
         }

js/xpconnect/src/XPCString.cpp

@@ -29,20 +29,25 @@
 static nsStringBuffer* sCachedBuffer = nullptr;
 static JSString* sCachedString = nullptr;
 
+// Called from GC finalize callback to make sure we don't hand out a pointer to
+// a JSString that's about to be finalized by incremental sweeping.
+// static
+void
+XPCStringConvert::ClearCache()
+{
+    sCachedBuffer = nullptr;
+    sCachedString = nullptr;
+}
+
 static void
 FinalizeDOMString(const JSStringFinalizer *fin, jschar *chars)
 {
     nsStringBuffer* buf = nsStringBuffer::FromData(chars);
-    if (buf == sCachedBuffer) {
-        sCachedBuffer = nullptr;
-        // No need to clear sCachedString
-    }
     buf->Release();
 }
 
 static const JSStringFinalizer sDOMStringFinalizer = { FinalizeDOMString };
 
-
 // convert a readable to a JSString, copying string data
 // static
 jsval

js/xpconnect/src/xpcprivate.h

@@ -3437,6 +3437,8 @@ public:
     static jsval ReadableToJSVal(JSContext *cx, const nsAString &readable,
                                  nsStringBuffer** sharedBuffer);
 
+    static void ClearCache();
+
 private:
     XPCStringConvert();         // not implemented
 };