1538622 - StructuredClone out of order when back reference and custom w/r function is involved

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[violet.bugreport]

Attachment: out-of-order-backreference.html

Step to reproduce:

Open the attached file. When backreference is involved, the copied data from postMessage() is out of order and even refer to the inner part an irrelevant object.

Comment 1

[violet.bugreport]

Attachment: Bug 1538622 - StructuredClone serialize and deserialize should treat back reference consistently

1. If an object needs a custom function to |write|, it will be added to |memory|
   in |JSStructuredCloneWriter| before calling the custom function. But in
   JSStructuredCloneReader::startRead we did the opposite. This will cause
   out-of-order if the custom function also writes some objects (e.g.
   WriteStructuredCloneImageData). We fix this by keeping the same order in
   |startRead|.
2. |JS_WriteTypedArray| should not call |writeTypedArray| directly, because it
   will miss an entry in |memory| for the typed array itself, which is required
   by the |readTypedArray| method. We fix this by calling |startWrite| which will
   handle this problem.

Comment 2

[violet.bugreport]

Hi Jason,

I submitted this patch a few days ago, could you review it? This bug is kind of serious, it will randomly reorder objects after structured clone, which is the cause of an immediate whole browser (not only the tab) crash in bug 1505821.

Since this is my first patch to the JS engine component, I might be choosing reviewer incorrectly. In case I'm wrong, could you point me to the correct reviewer?

Thanks!

Comment 3

[Jason Orendorff [:jorendorff]]

You're right, I'm just overwhelmed with reviews right now. (Unfortunately the other person best suited to review this is even more buried.)

I will review this in the next 3 hours though.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/aca6f427e048
StructuredClone serialize and deserialize should treat back reference consistently r=jorendorff

Comment 5

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/aca6f427e048