Closed Bug 1600018 Opened 1 year ago Closed 1 year ago

Assertion failure: this->is<T>(), at js/src/vm/JSObject.h:512 with finalization groups

Categories

(Core :: JavaScript: GC, defect, P1)

defect

Tracking

()

RESOLVED FIXED
mozilla73
Tracking Status
firefox72 --- wontfix
firefox73 --- fixed

People

(Reporter: anba, Assigned: jonco)

Details

Attachments

(1 file)

The following two test cases assert with Assertion failure: this->is<T>(), where T is FinalizationRecordObject in GCRuntime::sweepFinalizationGroups.

var g = newGlobal({newCompartment: true});
var group = new g.FinalizationGroup(x => {});

var target = {};
group.register(target);
target = null;

nukeAllCCWs();

gc();
var g = newGlobal({newCompartment: true});
var group = new g.FinalizationGroup(x => {});

var target = {};
var token = {};
group.register(target, null, token);

group.unregister(token);

nukeAllCCWs();

gc();
Assignee: nobody → jcoppeard
Priority: -- → P1

Where a FinalizationGroup and its target are in different compartments they are linked by a CCW from a map in the target's zone to the FinalizationGroup. This deals with what happens if we nuke the CCWs between these two compartments. I think the sensible thing to do in this case is to not call the FinalizationGroup's callback and effectively forget about the registrations. Nuking CCWs happens when compartments are known to be dead and therefore this is similar to the way don't call callbacks on shutdown.

Depends on D55114

Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/492e2599e9ed
Skip processing FinalizationGroups where the CCWs from the target to the FinalizationGroup object have been nuked r=sfink
Status: NEW → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla73

Do we need this in 72?

Flags: needinfo?(jcoppeard)

This functionality is shell-only for now, so I don't think we need to uplift.

Flags: needinfo?(jcoppeard)
You need to log in before you can comment on or make changes to this bug.