[gjs/wip/ptomato/mozjs31: 20/25] object: Use JS::Heap::setToCrashOnTouch() to poison weak ref

[Philip Chimento <pchimento src gnome org>]

commit d4090366e756a314b062a5396bde0cccae6e04d6
Author: Philip Chimento <philip endlessm com>
Date:   Thu Nov 3 15:57:20 2016 -0700

    object: Use JS::Heap::setToCrashOnTouch() to poison weak ref
    
    This replaces our previous sentinel value for the JS::Heap pointer. It's
    slightly better than the previous implementation because we can keep the
    same JS::Heap wrapper instead of removing it and replacing it.
    
    Sadly, JS::Heap::isSetToCrashOnTouch() doesn't work properly, I've filed
    a bug about it [1].
    
    [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1315122

 gi/object.cpp |   11 +++++------
 1 files changed, 5 insertions(+), 6 deletions(-)
---
diff --git a/gi/object.cpp b/gi/object.cpp
index 0af0977..8c7d211 100644
--- a/gi/object.cpp
+++ b/gi/object.cpp
@@ -1991,17 +1991,17 @@ ensure_heap_wrapper(GObject *gobj)
 static JSObject*
 peek_js_obj(GObject *gobj)
 {
-    auto heap_object = ensure_heap_wrapper(gobj);
+    JSObject *object = ensure_heap_wrapper(gobj)->get();
 
-    if (G_UNLIKELY ((gpointer) heap_object == (gpointer) 1)) {
+    /* FIXME: isSetToCrashOnTouch() broken */
+    if (G_UNLIKELY (object == (JSObject *) 1)) {
         g_critical ("Object %p (a %s) resurfaced after the JS wrapper was finalized. "
                     "This is some library doing dubious memory management inside dispose()",
                     gobj, g_type_name(G_TYPE_FROM_INSTANCE(gobj)));
-        g_object_set_qdata(gobj, gjs_object_priv_quark(), NULL);
         return NULL; /* return null to associate again with a new wrapper */
     }
 
-    return heap_object->get();
+    return object;
 }
 
 static void
@@ -2014,8 +2014,7 @@ set_js_obj(GObject  *gobj,
 static void
 poison_js_obj(GObject *gobj)
 {
-    /* COMPAT: Use JS::Heap::setToCrashOnTouch() in mozjs31 */
-    g_object_set_qdata(gobj, gjs_object_priv_quark(), (gpointer) 1);
+    ensure_heap_wrapper(gobj)->setToCrashOnTouch();
 }
 
 JSObject*