455765 - TM: bad JIT interactions with Ubiquity [@ js_FastNewObject]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

We've seen a few bugs where we crash with JIT enabled if Ubiquity is installed, but are OK if not.  A quick conversation with Jono raised the possibility that it's related to evalInSandbox, which seems quite plausible to me given how that would give us unusual scope and global-object properties.  Going to collect these cases under this bug so we can see if they are amenable to a systematic solution.

(Making sure we don't trace under eIS might be a reasonable interim step?)

Comment 1

[Andreas Gal :gal]

There is a parallel bug on file (crashing sunspider with ubiquity installed).

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

I indeed crash in SunSpider /w Ubiquity

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

The problem here is that Ubiquity causes us to resolve the Window class way before we ever create a content window. This causes us to create a shared scriptable prototype (and all that fun stuff for it) from a place that doesn't funnel into nsXPConnect::InitClassesWithNewWrappedGlobal. That means that we create the JS class (but don't use it!) without the proper global flags.

The easiest way to fix it is to notice this when we create the first instance of the window and set the global flags then. Note that we haven't created any instances of the object when we do this sneaky class manipulation!

Comment 4

[Johnny Stenback (:jst)]

Comment on attachment 340480 [details] [diff] [review]
Proposed fix

+    if(isGlobal)
+    {
+        if(!(jsclazz->flags & JSCLASS_IS_GLOBAL))
+            jsclazz->flags |= JSCLASS_GLOBAL_FLAGS;

Here we could unconditionally set this bit and avoid the check, IMO.

r+sr=jst, but please do add a comment explaining why this is needed.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Pushed as http://hg.mozilla.org/mozilla-central/rev/de88f8e08da9 (with a comment).