FinalizationRegistry may hold onto FinalizationRecordObjects longer than necessary
Categories
(Core :: JavaScript: GC, defect, P1)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox76 | --- | fixed |
People
(Reporter: jonco, Assigned: jonco)
References
Details
Attachments
(1 file)
There are two problems:
- pointers to records in the registration weak map are not removed when cleanup is queued for a target (because we don't know the unregister token at that point)
- pointers to records in the active records set are not removed if cleanup is cancelled when a CCW from the target's finalization record map is nuked
One way to fix this is to make contents of the registration weakmap's values weak (as well as just the values themselves) and the contents of the active record set weak as well.
An alternative approach might be to restrict sweep groups such that a FinalizationRegistry is always swept in the same group as its targets (and unregister tokens too I guess). That would probably be simpler overall but might make sweeping less efficient, and would also add some complexity in other places.
|
Assignee | |
Comment 1•4 years ago
|
||
This removes tracing for the values of the registration map and the active record set and sweeps them instead. This requires maintaining a map of FinalizationRegistryObjects on the zone.
Pushed by jcoppeard@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/5a6684922b98 Make FinalizationRegistryObject active record set and registrations map values weak r=sfink
|
||
Comment 3•4 years ago
|
||
| bugherder | ||
|
||
Comment 4•4 years ago
|
||
Could this have caused bug 1624276?
|
|
Assignee | |
Comment 5•4 years ago
|
||
(In reply to Marco Castelluccio [:marco] from comment #4)
No, I don't think so.
Description
•