For this code in GCUntilDone: /* * We should not be depending on cx->compartment in the GC, so set it to * NULL to look for violations. */ SwitchToCompartment(cx, (JSCompartment *)NULL); SwitchToCompartment is a class, and when class constructors are called as functions the destructor is called immediately afterwards (thanks, C++!), so the original context's usually-bogus compartment is restored for the GC.
Oops. We have checks to ensure that this doesn't happen, but I guess they aren't called by SwitchCompartment. We should fix that.
Hmm, this was the only hit for SwitchCompartment being called as a function. Unfortunately, doing the obvious fix for this case broke some jit-tests in non-obvious ways, going to disown.
Wow, nice. Ok, we need an owner and fixing. Gregor? Bill? Anyone?
I've only looked at one failure so far, but here's what I think is happening. In MarkRuntime, we iterate over all contexts cx and mark cx->compartment. NULLing-out cx->compartment during GC causes us to miss a compartment. Once bug 639270 lands, this shouldn't be a problem. Let's wait for that and then fix this.
If you add the idiomatic JS_GUARD_OBJECT_NOTIFIER* magic (grep for examples), then you will get a debug assert running the statement in comment 0. (In theory, we should be sprinkling this magic on all guard objects to prevent this category of errors.)
The verb-style name fooled me into thinking this was an overloaded function, not a class. Use noun phrases for classes and structs, please! /be
I didn't really like it at first, but the pattern seems to be an Auto* prefix.
Created attachment 518562 [details] [diff] [review] fix This fixes the GC case and adds the necessary guards to SwitchToCompartment. Now that bug 639270 has landed, there are no more test failures. I didn't do any renaming. Should I?
Filed bug 641558 on the renaming.