617836 - XBL re-creates wrappers to its injected prototype object from their prototype chains

Status: RESOLVED FIXED

(Core :: XBL, defect)

Description

[Blake Kaplan (:mrbkap) (inactive)]

With the patch for bug 616992, I noticed that when we evict viewers from the bfcache, we detach XBL bindings that have been attached in those documents. In the process of detaching XBL bindings, we try to remove the prototype object that XBL inserts into their prototype chains. In order to get the JS object, we wrap the bound node. However, if the node was collected by GC, then we'll create a *new* wrapped native for the purpose of looking up its prototype chain and not finding the XBL binding. We can avoid some work by using a different API that returns null if the object doesn't exist (i.e. XPCWrappedNative::GetUsedOnly).

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: diff -w

Comment 3

[Johnny Stenback (:jst)]

Comment on attachment 496387 [details] [diff] [review]
Proposed fix

r+a=jst (and while this isn't a blocker, it came out of an attempt to fix a blocker. This makes us do less work, so in some cases this can speed things up, and thus I think we should go ahead and take it anyways. But let's wait until beta8 is out the door)

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/tracemonkey/rev/70ca11974a2b

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/70ca11974a2b