1139696 - Cloned Set is empty if the Set is created in another JSM

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Matthew N. [:MattN]]

Attachment: Testcase patch that outputs to the Browser Console

If I use sendAsyncMessage with a Set created in a different JSM, the Set is empty on the receiving side. Here is the output from the testcase:

> "parent" Set [ 1, /foo/, 3 ] Testcase.jsm:46
Notice how there are 3 items in the set from the JSM in the parent.
> "received in child:" Object { regexp: /foo/, set: Set[3], setFromJSM: Set[0] } 
Notice that `set` has 3 items and `setFromJSM` now has 0 despite them being constructed in similar ways but in different JSMs.
> "setFromJSM" "[object Set]"
> "set" "[object Set]"
Both are still Set objects
> "setFromJSM" Array [  ]
> "set" Array [ 1, /foo/, 3 ]
The contents of the set created in Testcase2.jsm are missing.

I would guess this is related to wrappers.

Comment 1

[Matthew N. [:MattN]]

Note that the problem doesn't occur if I change the Set to an Array. It also happens regardless of whether e10s is on or not.

Comment 2

[Bobby Holley (:bholley)]

I don't have the cycles to look at this right now, sorry.

Does the problem reproduce if you just do Cu.cloneInto between JSMs instead of using the message manager? That would imply that the problem lies with our Set/Map cloning in js/src/vm/StructuredClone.cpp.

Tom, do you have a minute to help Matt out?

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: Fix cross-compartment Map/Set structured cloning

Comment 4

[Tom S]

Attachment: free test

free test, please include this.

Comment 5

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/746240a9e4bd
https://hg.mozilla.org/integration/mozilla-inbound/rev/5ddbdbc00f3c

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/746240a9e4bd
https://hg.mozilla.org/mozilla-central/rev/5ddbdbc00f3c