1349637 - Remove unnecessary expose call when unwrapping a wrapper

Status: RESOLVED INVALID

(Core :: JavaScript: GC, enhancement)

Description

[Jon Coppeard (:jonco)]

Attachment: remove-wrapper-target-expose

Back in bug 1298773 we added a call to ExposeObjectToActiveJS in Wrapper::wrappedObject.  The problem seemed to be that you could unwrap a black wrapper but receive a gray target when unwrapping.

This is now no longer possible for two reasons: we ensure that we do an expose on wrapper targets when mark the wrapper black even if the target is not in a zone that we're collecting, and we updated our assertions to ignore cases where the object is temporarily gray but we know the GC will mark it black in the future.

Here is a patch to remove the expose and replace it with an assertion that the result is not gray.

I had to add an expose call when recomputing wrappers by compartment as the target can be gray here.

I also added some additional assertions that setting an object's private to a GC thing does not create a black to gray edge.

Try results look good so far: https://treeherder.mozilla.org/#/jobs?repo=try&revision=85a2f9c168d66506283a484e3230f1e53321eaa8&group_state=expanded&selectedJob=85668400

Comment 1

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2c8aea7a6fa9
Don't expose wrapper targets r=sfink

Comment 2

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/2c8aea7a6fa9

Comment 3

[Jon Coppeard (:jonco)]

As pointed out in bug 1350248, this expose call is currently necessary after all, so I'm backing this out:

https://hg.mozilla.org/integration/mozilla-inbound/rev/43c977e120c535bb198c4be52a378ea7dc129690

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Backout merged to m-c: https://hg.mozilla.org/mozilla-central/rev/43c977e120c5