Files
servo/components/script/dom/webgpu
Josh Matthews d86d2a90aa script: Use rooted typed arrays in generated code and buffer source APIs (#41228)
There are two flavours of the mozjs `TypedArray<T>` wrapper for typed
array objects: one stores a `Box<Heap<*mut JSObject>>`, while the other
just has a bare `*mut JSObject`. The second one must only be stored
inside the `CustomAutoRoot` rooting values, but we were using it in many
other places like WebIDL dictionaries without rooting it safely. These
changes make our typed array APIs always use
`RootedTraceableBox<TypedArray<T>>` with the `Box<Heap<*mut JSObject>>`
flavour, which ensures that the JS object stored inside the typed array
wrapper is always visible to the SpiderMonkey GC.

Testing: Adds a new test that crashes without these changes.
Fixes: #41206

---------

Signed-off-by: Josh Matthews <josh@joshmatthews.net>
2025-12-12 14:33:45 +00:00
..