1600019 - Missing OOM handling in registerWithFinalizationGroup and uninitialised FinalizationRecordVectorObject when tracing

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect, P1)

Description

[André Bargull [:anba]]

This test case asserts with Assertion failure: cx->isExceptionPending() (Thunk execution failed but no exception was raised - missing call to js::ReportOutOfMemory()?):

let group = new FinalizationGroup(x => 0);
let target = {};
let token = {};
oomTest(() => group.register(target, 1, token));

This test case asserts with Assertion failure: isDouble():

enableShellAllocationMetadataBuilder();
evaluate(`
  var group = new FinalizationGroup(x => 0);
  gczeal(9,3);
  group.register({}, 1, {});
`);

Comment 1

[André Bargull [:anba]]

Attachment: Bug 1600019 - Part 1: Handle OOM in registerWithFinalizationGroup. r=jonco!

Comment 2

[André Bargull [:anba]]

Attachment: Bug 1600019 - Part 2: Handle the case when FinalizationRecordVectorObject's records slot is uninitialised. r=jonco!

Depends on D55086

Comment 3

[André Bargull [:anba]]

Attachment: Bug 1600019 - Part 3: Use NewObjectWithGivenProto when |prototype| argument is guaranteed to be non-null. r=jonco!

NewObjectWithClassProto when called with a non-null prototype calls NewObjectWithGivenTaggedProto,
but that function can be called more directly through NewObjectWithGivenProto.

Depends on D55087

Comment 4

[André Bargull [:anba]]

Attachment: Bug 1600019 - Part 4: Prefer js::Call over JS::Call for engine-internal calls. r=jonco!

js::Call avoids copying the arguments into a separate InvokeArgs struct,
therefore it's generally preferred for calls within SpiderMonkey.

Depends on D55088

Comment 5

[André Bargull [:anba]]

Attachment: Bug 1600019 - Part 5: Avoid rooting a handle-value. r=jonco!

Depends on D55089

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/889b0858a957
Part 1: Handle OOM in registerWithFinalizationGroup. r=jonco
https://hg.mozilla.org/integration/autoland/rev/ad0a7949dd8e
Part 2: Handle the case when FinalizationRecordVectorObject's records slot is uninitialised. r=jonco
https://hg.mozilla.org/integration/autoland/rev/bc921ac2bd1b
Part 3: Use NewObjectWithGivenProto when |prototype| argument is guaranteed to be non-null. r=jonco
https://hg.mozilla.org/integration/autoland/rev/3de775ee7d0e
Part 4: Prefer js::Call over JS::Call for engine-internal calls. r=jonco
https://hg.mozilla.org/integration/autoland/rev/273f738dab5f
Part 5: Avoid rooting a handle-value. r=jonco

Comment 7

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/889b0858a957
https://hg.mozilla.org/mozilla-central/rev/ad0a7949dd8e
https://hg.mozilla.org/mozilla-central/rev/bc921ac2bd1b
https://hg.mozilla.org/mozilla-central/rev/3de775ee7d0e
https://hg.mozilla.org/mozilla-central/rev/273f738dab5f