1322539 - Sort our the gray invariant situation with Xrays

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Boris Zbarsky [:bzbarsky]]

I just had a test run fail like so:

Assertion failure: !JS::ObjectIsMarkedGray(target), at /home/worker/workspace/build/src/js/src/jsapi.cpp:725

with a stack like this:

0  libxul.so!JSAutoCompartment::JSAutoCompartment [jsapi.cpp:3c4efe4d91d0 : 725 + 0x0]
1  libxul.so!xpc::XrayTraits::getExpandoObjectInternal [XrayWrapper.cpp:3c4efe4d91d0 : 1076 + 0xf]
2  libxul.so!xpc::XrayTraits::resolveOwnProperty [XrayWrapper.cpp:3c4efe4d91d0 : 1452 + 0x5]
3  libxul.so!xpc::DOMXrayTraits::resolveOwnProperty [XrayWrapper.cpp:3c4efe4d91d0 : 1627 + 0x6]
4  libxul.so!xpc::XrayWrapper<js::CrossCompartmentWrapper, xpc::DOMXrayTraits>::getOwnPropertyDescriptor [XrayWrapper.cpp:3c4efe4d91d0 : 2040 + 0x22]

The problem, of course, is that XrayTraits::resolveOwnProperty does this:

    RootedObject target(cx, getTargetObject(wrapper));
    if (!getExpandoObject(cx, target, wrapper, &expando))

where getExpandoObject then passes through "target" to getExpandoObjectInternal, which does:

    JSAutoCompartment ac(cx, target);

what getTargetObject does is:

  return js::UncheckedUnwrap(wrapper, /* stopAtWindowProxy = */ false);

OK, so as far as I can tell we could come into this code with "wrapper" white and "target" gray, if we have just started a compartment GC in the compartment of "wrapper".  And then this assertion failure would happen, right?

Note that we had a similar thing going on with Wrapper::wrappedObject and we made it always expose to active JS in bug 1298773, right?  Isn't this situation basically the same?

Comment 1

[Ryan VanderMeulen [:RyanVM]]

This signature appears to be hitting a lot on Fx52 since the uplift to Beta.
https://treeherder.mozilla.org/logviewer.html#?job_id=71802784&repo=mozilla-beta

Comment 2

[Jon Coppeard (:jonco)]

Status update: I'm working on these gray marking assertion failures but don't have a fix yet.  Please see the bugs I've filed under bug 1317672.

Comment 3

[Jon Coppeard (:jonco)]

Attachment: bug1322539-expose-xray-target

I experimented with making js::UncheckedUnwrap also call ExposeObjectToActiveJS, but it turns out that's called internally in a bunch of places where we can't do that (e.g. during GC).  Rather than add another variant of unwrap, just add the expose call at this site.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/6bea50011ab6
Call ExposeObjectToActiveJS on the targets of xray wrappers r=sfink

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/6bea50011ab6

Comment 6

[Gerry Chang [:gchang]]

Mark 54 won't fix as this is late for Beta54.