TM: calling SwitchToCompartment(NULL) does nothing

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: bhackett, Assigned: billm)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment)

(Reporter)

Description

7 years ago
For this code in GCUntilDone:

    /*
     * We should not be depending on cx->compartment in the GC, so set it to
     * NULL to look for violations.
     */
    SwitchToCompartment(cx, (JSCompartment *)NULL);

SwitchToCompartment is a class, and when class constructors are called as functions the destructor is called immediately afterwards (thanks, C++!), so the original context's usually-bogus compartment is restored for the GC.
(Assignee)

Comment 1

7 years ago
Oops. We have checks to ensure that this doesn't happen, but I guess they aren't called by SwitchCompartment. We should fix that.
(Reporter)

Comment 2

7 years ago
Hmm, this was the only hit for SwitchCompartment being called as a function.  Unfortunately, doing the obvious fix for this case broke some jit-tests in non-obvious ways, going to disown.
Assignee: bhackett1024 → general
(Assignee)

Updated

7 years ago
Assignee: general → wmccloskey

Comment 3

7 years ago
Wow, nice. Ok, we need an owner and fixing. Gregor? Bill? Anyone?
(Assignee)

Comment 4

7 years ago
I've only looked at one failure so far, but here's what I think is happening. In MarkRuntime, we iterate over all contexts cx and mark cx->compartment. NULLing-out cx->compartment during GC causes us to miss a compartment.

Once bug 639270 lands, this shouldn't be a problem. Let's wait for that and then fix this.

Comment 5

7 years ago
If you add the idiomatic JS_GUARD_OBJECT_NOTIFIER* magic (grep for examples), then you will get a debug assert running the statement in comment 0.  (In theory, we should be sprinkling this magic on all guard objects to prevent this category of errors.)
The verb-style name fooled me into thinking this was an overloaded function, not a class. Use noun phrases for classes and structs, please!

/be

Comment 7

7 years ago
I didn't really like it at first, but the pattern seems to be an Auto* prefix.
(Assignee)

Comment 8

7 years ago
Created attachment 518562 [details] [diff] [review]
fix

This fixes the GC case and adds the necessary guards to SwitchToCompartment. Now that bug 639270 has landed, there are no more test failures.

I didn't do any renaming. Should I?
Attachment #518562 - Flags: review?(luke)

Updated

7 years ago
Attachment #518562 - Flags: review?(luke) → review+
(Assignee)

Comment 9

7 years ago
http://hg.mozilla.org/tracemonkey/rev/655c1169d04b
Whiteboard: fixed-in-tracemonkey
(Assignee)

Comment 10

7 years ago
Filed bug 641558 on the renaming.
http://hg.mozilla.org/mozilla-central/rev/655c1169d04b
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.