From 83d89f944efbb4e8648a6d4aaf53a38e283db884 Mon Sep 17 00:00:00 2001
From: Marco Castelluccio <mcastelluccio@mozilla.com>
Date: Sun, 16 Jun 2024 06:20:41 +0000
Subject: [PATCH] Bug 1894442 - Allow shared atoms zone when checking weakmap
 keys r=sfink

This was an over-strict assertion getting the weakmap key's zone, which can
legitimately be the shared atoms zone.

Differential Revision: https://phabricator.services.mozilla.com/D209204

UltraBlame original commit: 62df6f06d6c6b340080abc282824ff30ce05743d
---
 js/src/gc/WeakMap-inl.h                 | 19 ++++++++++---------
 js/src/jit-test/tests/gc/bug-1894442.js | 24 ++++++++++++++++++++++++
 2 files changed, 34 insertions(+), 9 deletions(-)
 create mode 100644 js/src/jit-test/tests/gc/bug-1894442.js

diff --git a/js/src/gc/WeakMap-inl.h b/js/src/gc/WeakMap-inl.h
index 027fb358d38d..0f7cd344f365 100644
--- a/js/src/gc/WeakMap-inl.h
+++ b/js/src/gc/WeakMap-inl.h
@@ -2470,14 +2470,20 @@ allowKeysInOtherZones
 )
 )
 {
-MOZ_RELEASE_ASSERT
-(
+Zone
+*
+keyZone
+=
 key
 -
 >
-zone
+zoneFromAnyThread
 (
 )
+;
+MOZ_RELEASE_ASSERT
+(
+keyZone
 =
 =
 zone
@@ -2485,12 +2491,7 @@ zone
 )
 |
 |
-key
--
->
-zone
-(
-)
+keyZone
 -
 >
 isAtomsZone
diff --git a/js/src/jit-test/tests/gc/bug-1894442.js b/js/src/jit-test/tests/gc/bug-1894442.js
new file mode 100644
index 000000000000..021c25d52cb7
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1894442.js
@@ -0,0 +1,24 @@
+evalInWorker
+(
+a
+=
+new
+WeakSet
+a
+.
+add
+(
+Symbol
+.
+hasInstance
+)
+gczeal
+(
+14
+)
+(
+0
+.
+b
+)
+)