1291364 - Worker timeouts can call gray functions and pass gray arguments

Status: RESOLVED FIXED

(Core :: DOM: Workers, defect)

Description

[Boris Zbarsky [:bzbarsky]]

+++ This bug was initially created as a clone of Bug #1288770 +++

Just going to do the manual JS::ExposeValueToActiveJS calls for now, so we can land spidermonkey asserts.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Make sure workers unmark things gray before passing them to JS_CallFunctionValue when running timeouts

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2deb6ffa4b55
Make sure workers unmark things gray before passing them to JS_CallFunctionValue when running timeouts.  r=terrence

Comment 3

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/2deb6ffa4b55

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8777033 [details] [diff] [review]
Make sure workers unmark things gray before passing them to JS_CallFunctionValue when running timeouts

Approval Request Comment
[Feature/regressing bug #]: None
[User impact if declined]: Possible GC crashes and other such badness
[Describe test coverage new/current, TreeHerder]: This codepath is tested in
   general, yes.
[Risks and why]: This is extremely low risk.
[String/UUID change made/needed]: None.

Comment 5

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8777033 [details] [diff] [review]
Make sure workers unmark things gray before passing them to JS_CallFunctionValue when running timeouts

Crash fix, has stabilized on Nightly for a few weeks, Aurora50+

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/f4b3eabf7371