Closed Bug 1654523 Opened 2 months ago Closed 2 months ago

Insist that iteration callbacks don't GC

Categories

(Core :: JavaScript: GC, enhancement, P1)

enhancement

Tracking

()

RESOLVED FIXED
mozilla80
Tracking Status
firefox80 --- fixed

People

(Reporter: jonco, Assigned: jonco)

Details

Attachments

(1 file)

We have a bunch of iteration APIs for things like realms and compartments that take a callback function and call it with a pointer to thing being iterated. It would be bad if those callbacks caused GC to happen since this could potentially delete the passed pointer.

There are some mitigations in place: AutoPrepareForTracing is used in some iterators that finishes the current incremental GC (but this is not used everywhere and doesn't prevent new ones from being started). The realm iteration functions pass a handle to a realm (but there's no read barrier to prevent a realm read during an incremental GC from being collected by a subsequent GC slice).

I don't think anything bad happens at the moment but it took me a while to convince myself of this. Therefore I think it would be useful to make things more obviously correct by outlawing GC during these iteration callbacks.

Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/343c3c55fb9e
Insist that iteration callbacks don't GC r=sfink,mccr8
Status: NEW → RESOLVED
Closed: 2 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla80
You need to log in before you can comment on or make changes to this bug.