Bugzilla

> so Observe() implementations must not spin the event loop

OK, but that doesn't mean they don't.

> where running arbitrary code can be avoided.

Past experience shows that it _can_ be avoided, if one tries pretty hard (e.g. no interaction with web pages), but often _isn't_ avoided... and JS doesn't have very good visibility into what changes it's making even if you stick to chrome JS.

> I assume MOZ_CAN_RUN_SCRIPT is intended to mean "caller must hold strong refs"

That is correct.

> which is not necessary in general if arbitrary changes will not be made

That is true, but in general it's hard to predict what changes random callees will or will not make if you have no idea what those callees are.

As a specific example, notifying "memory-pressure" via the observer service will cause all sorts of caches to be cleared, dropping references to things in the process.

It's possible we can scope things down somewhat if it's really needed (i.e. if we have cases where the caller can't hold strong refs), though it seems like in those cases it can MOZ_KnownLive, if it thinks that holds.  And then we can audit appropriately to see whether it holds.

> so Observe() implementations must not spin the event loop

OK, but that doesn't mean they don't.

> where running arbitrary code can be avoided.

Past experience shows that it _can_ be avoided, if one tries pretty hard (e.g. no interaction with web pages), but often _isn't_ avoided... and JS doesn't have very good visibility into what changes it's making even if you stick to chrome JS.

> I assume MOZ_CAN_RUN_SCRIPT is intended to mean "caller must hold strong refs"

That is correct.

> which is not necessary in general if arbitrary changes will not be made

That is true, but in general it's hard to predict what changes random callees will or will not make if you have no idea what those callees are.

As a specific example, notifying "memory-pressure" via the observer service will cause all sorts of caches to be cleared, dropping references to things in the process.

It's possible we can scope things down somewhat if it's really needed (i.e. if we have cases where the caller can't hold strong refs), though it seems like in those cases it can use `MOZ_KnownLive`, if it thinks that holds.  And then we can audit appropriately to see whether it holds.