Closed Bug 1139696 Opened 6 years ago Closed 6 years ago

Cloned Set is empty if the Set is created in another JSM


(Core :: JavaScript Engine, defect)

Not set



Tracking Status
e10s ? ---
firefox39 --- fixed


(Reporter: MattN, Assigned: billm)




(3 files)

If I use sendAsyncMessage with a Set created in a different JSM, the Set is empty on the receiving side. Here is the output from the testcase:

> "parent" Set [ 1, /foo/, 3 ] Testcase.jsm:46
Notice how there are 3 items in the set from the JSM in the parent.
> "received in child:" Object { regexp: /foo/, set: Set[3], setFromJSM: Set[0] } 
Notice that `set` has 3 items and `setFromJSM` now has 0 despite them being constructed in similar ways but in different JSMs.
> "setFromJSM" "[object Set]"
> "set" "[object Set]"
Both are still Set objects
> "setFromJSM" Array [  ]
> "set" Array [ 1, /foo/, 3 ]
The contents of the set created in Testcase2.jsm are missing.

I would guess this is related to wrappers.
Flags: needinfo?(bobbyholley)
Note that the problem doesn't occur if I change the Set to an Array. It also happens regardless of whether e10s is on or not.
See Also: → 1139718
I don't have the cycles to look at this right now, sorry.

Does the problem reproduce if you just do Cu.cloneInto between JSMs instead of using the message manager? That would imply that the problem lies with our Set/Map cloning in js/src/vm/StructuredClone.cpp.

Tom, do you have a minute to help Matt out?
Flags: needinfo?(bobbyholley) → needinfo?(evilpies)
Assignee: nobody → wmccloskey
Attached patch free testSplinter Review
free test, please include this.
Flags: needinfo?(evilpies)
Attachment #8573596 - Flags: review?(evilpies) → review+
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla39
You need to log in before you can comment on or make changes to this bug.