1600018 - Assertion failure: this->is<T>(), at js/src/vm/JSObject.h:512 with finalization groups

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect, P1)

Description

[André Bargull [:anba]]

The following two test cases assert with Assertion failure: this->is<T>(), where T is FinalizationRecordObject in GCRuntime::sweepFinalizationGroups.

var g = newGlobal({newCompartment: true});
var group = new g.FinalizationGroup(x => {});

var target = {};
group.register(target);
target = null;

nukeAllCCWs();

gc();

var g = newGlobal({newCompartment: true});
var group = new g.FinalizationGroup(x => {});

var target = {};
var token = {};
group.register(target, null, token);

group.unregister(token);

nukeAllCCWs();

gc();

Comment 1

[Jon Coppeard (:jonco)]

Attachment: Bug 1600018 - Skip processing FinalizationGroups where the CCWs from the target to the FinalizationGroup object have been nuked r?sfink

Where a FinalizationGroup and its target are in different compartments they are linked by a CCW from a map in the target's zone to the FinalizationGroup. This deals with what happens if we nuke the CCWs between these two compartments. I think the sensible thing to do in this case is to not call the FinalizationGroup's callback and effectively forget about the registrations. Nuking CCWs happens when compartments are known to be dead and therefore this is similar to the way don't call callbacks on shutdown.

Depends on D55114

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/492e2599e9ed
Skip processing FinalizationGroups where the CCWs from the target to the FinalizationGroup object have been nuked r=sfink

Comment 3

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/492e2599e9ed

Comment 4

[Julien Cristau [:jcristau] (back April 22)]

Do we need this in 72?

Comment 5

[Jon Coppeard (:jonco)]

This functionality is shell-only for now, so I don't think we need to uplift.