787710 - Proxy survives after a refresh

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[David Bruant]

Bug found in Nightly built from http://hg.mozilla.org/mozilla-central/rev/a21fd4d085ad on Linux 32 bits.

I have exposed the test case in a specific tag: https://github.com/DavidBruant/HarmonyProxyLab/tree/survivingProxyBug/ProxyArray
The goal of this code is to emulate native arrays with direct proxies using only "normal objects".

For the very first test, the first time it passes (length of the proxyArray is 0).
After a refresh, the test fails with the proxy having a length of 10 (which it has no reason to, but is the value it certainly was in the previous session).
After another refresh, the test passes. After another refresh, it fails and so on.

It seems that the proxy (or at least some info) survives a refresh, which is pretty bad.

Comment 1

[David Bruant]

It might be that the proxy (and target) is reallocated at the same place twice, that the memory has not been erased.

Comment 2

[Boris Zbarsky [:bzbarsky]]

David, what are the actual steps to reproduce here?

I tried this:

1)  cd /tmp
2)  git clone https://github.com/DavidBruant/HarmonyProxyLab.git
3)  Load file:///tmp/HarmonyProxyLab/ProxyArray/Arrays.html

I get an error in the error console:

  [10:44:56.451] ReferenceError: VirtualHandler is not defined @
   file:///tmp/HarmonyProxyLab/ProxyArray/ProxyArray.js:11

and an error message in the web page:

  Script error.
  Source: file:///tmp/HarmonyProxyLab/ProxyArray/ProxyArray.js:0

What do I need to do differently here?

Comment 3

[David Bruant]

(In reply to Boris Zbarsky (:bz) from comment #2)
> 1)  cd /tmp
> 2)  git clone https://github.com/DavidBruant/HarmonyProxyLab.git
3) git checkout survivingProxyBug
> [4])  Load file:///tmp/HarmonyProxyLab/ProxyArray/Arrays.html

checking out generates a warning that you can ignore
I added the tag to be sure to keep in mind the code that has the bug

Comment 4

[David Bruant]

I'm on a different computer (Linux 64-bits) and I can see the bug here too.

Comment 5

[Boris Zbarsky [:bzbarsky]]

This is weird.  I do see the issue on Mac, but if I make the code look like so:

var a = new ProxyArray();
console.log(a.length);

test('init', function(){
    console.log(a.length)
});

then I reliably see 0 logged from the first log() call, while the second one alternates between 0 and 10.  That's... quite odd.

Comment 6

[Eddy Bruel [:ejpbruel]]

I will take a look at this the coming week

Comment 7

[Tom S [:evilpie]]

Does that still reproduce?

Comment 8

[David Bruant]

(In reply to Tom Schuster [:evilpie] from comment #7)
> Does that still reproduce?
I still see it (Aurora 23, Linux 64). When trying to comment out some tests, the issue disappears. Really weird...

Comment 9

[David Bruant]

Attachment: Test case

Open the HTML file in the browser and hit F5 to see the first test switch between success and failure

Comment 10

[Boris Zbarsky [:bzbarsky]]

That testcase relies on a ../qunit.js which it does not include.

Comment 11

[David Bruant]

Attachment: Test case

Self-sufficient archive this time

Comment 12

[David Bruant]

(In reply to Boris Zbarsky (:bz) from comment #10)
> That testcase relies on a ../qunit.js which it does not include.
My bad.

Comment 13

[Boris Zbarsky [:bzbarsky]]

Yeah, that reproduces again, thank you.

Comment 14

[David Bruant]

Happy to say I cannot reproduce the bug from the self-sufficient archive on Firefox Developer Edition (37.0a2).
The proxy implementation and GC went under major changes, so I guess this is that.

Comment 15

[Tom S [:evilpie]]

Thanks David, marking as resolved.