1503399 - Investigate possible assertion failure: UnwrapReaderFromStreamNoThrow(stream) == reader in ReadableStreamReaderGenericRelease

Status: RESOLVED FIXED

(Core :: JavaScript Engine, enhancement, P1)

Description

[Jason Orendorff [:jorendorff]]

There is indeed an invariant in the standard that streams and readers have slots that point to each other.

But in our implementation, those edges can be CCWs and they can be killed individually. We can probably get this assertion to fail by nuking the Stream's CCW that points to the Reader, but not the Reader's CCW that points to the Stream.

Comment 1

[Jason Orendorff [:jorendorff]]

Yep.

let g = newGlobal();
let stream = new ReadableStream({});
g.stream = stream;
g.eval("var reader = ReadableStream.prototype.getReader.call(stream);");
nukeCCW(g.reader);
g.eval("reader.releaseLock();");

Assertion failure: UnwrapReaderFromStreamNoThrow(unwrappedStream) == unwrappedReader, at /Users/jorendorff/work/gecko/js/src/builtin/Stream.cpp:1983
Segmentation fault: 11

Comment 2

[Jason Orendorff [:jorendorff]]

Attachment: Bug 1503399 - Weaken assertion to allow for stream.[[reader]] being a dead object. r?jwalden

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c4de0c7b78ed
Weaken assertion to allow for stream.[[reader]] being a dead object. r=jwalden

Comment 4

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/c4de0c7b78ed