1166209 - Disallow JS execution while iterating over the JS heap

Status: NEW

(Core :: JavaScript Engine, defect, P3)

Description

[Nicholas Nethercote [inactive]]

The JS memory reporter iterates over the JS heap. While this is happening it's vital that no JS code executes, otherwise we can get crashes like bug 1103375's. There are some ad hoc mechanisms in there but something general would be better.

mrbkap suggested this:

> One other idea would be to set a bit somewhere in XPConnect when we're
> iterating the JS heap and to refuse (in nsXPCWrappedJSClass) to call back
> into JS from C++ (we'd probably want to assert in debug builds as well as
> throwing in optimized builds) when the bit is set. That way, other bugs
> like this wouldn't crash us.

Comment 1

[Andrew McCreight [:mccr8]]

There are some existing RAII classes that forbid running JS, though I'm not sure they fail gracefully.