327708 - fun_xdrObject should root fun across call to js_XDRScript

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

This is the cause of the first crash I hit when trying to start Firefox with WAY_TOO_MUCH_GC.  The object allocated in fun_xdrObject at jsfun.c:1220 needs to be rooted across the call to js_XDRScript at jsfun.c:1337, or else it could potentially be collected here:

js_GC (/builds/trunk/mozilla/js/src/jsgc.c:1947)
js_NewGCThing (/builds/trunk/mozilla/js/src/jsgc.c:635)
js_NewString (/builds/trunk/mozilla/js/src/jsstr.c:2529)
js_NewStringCopyN (/builds/trunk/mozilla/js/src/jsstr.c:2644)
js_AtomizeString (/builds/trunk/mozilla/js/src/jsatom.c:664)
js_AtomizeChars (/builds/trunk/mozilla/js/src/jsatom.c:755)
js_XDRStringAtom (/builds/trunk/mozilla/js/src/jsxdrapi.c:675)
js_XDRAtom (/builds/trunk/mozilla/js/src/jsxdrapi.c:627)
XDRAtomMap (/builds/trunk/mozilla/js/src/jsscript.c:370)
js_XDRScript (/builds/trunk/mozilla/js/src/jsscript.c:501)
fun_xdrObject (/builds/trunk/mozilla/js/src/jsfun.c:1337)

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: possible patch

This works around the problem for me; no idea if it's the recommended way within the JS engine, whether it has threadsafety problems, etc.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

I'll take this... the current hip way to protect objects from GC in situations like this is to use JSTempValueRooter (see jscntxt.h).

Unfortunately, your patch isn't quite sufficient. There are calls to js_Atomize (and js_AtomizeString) that could also possibly collect func. This is one place where I _really_ miss C++'s nice destructors. I'll take this and root fun across fun_xdrObject.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Using tvrs across the whole function

It seemed cleaner to me to to common out the ok = JS_FALSE setting into the two labels than the other options.

Comment 4

[Brendan Eich [:brendan]]

Comment on attachment 215958 [details] [diff] [review]
Using tvrs across the whole function

>+    v = OBJECT_TO_JSVAL(fun->object);

Get rid of jsval v local, it is not needed -- JS_PUSH_SINGLE_TEMP_ROOT takes an arbitrary expression that evaluates to a jsval.

>+cleanup:

Canonical label name is out.

Fix these and r=me.

/be

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into trunk.

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Any chance of getting this on 1.8.1; maybe even 1.8.0.3?

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 215958 [details] [diff] [review]
Using tvrs across the whole function

This patch has been baking on the trunk for a month with no known regressions. It uses an established method for protecting jsvals from begin GC'd.

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 215958 [details] [diff] [review]
Using tvrs across the whole function

aproved for 1.8.0 branch, a=dveditz for drivers

Comment 9

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into both 1.8 branches.

Comment 10

[Bob Clary [:bc] (inactive)]

David, did you have a test for this?

Comment 11

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Starting up Firefox (not the first time, presumably).