Bug 1573419 - Fix assertion failure finalizing JSObjects during shutdown r=bzbarsky
authorJon Coppeard <jcoppeard@mozilla.com>
Thu, 15 Aug 2019 08:29:26 +0000
changeset 488196 9a51c0c9a0f7b16b0fbaa675300e8b4b29add727
parent 488195 fa0807f1afad6b15d1675687a50777886c3e2a2a
child 488197 1f3fcdc28dfddb3b0afdd53cbf2c65394332d0da
push id36437
push userncsoregi@mozilla.com
push dateThu, 15 Aug 2019 19:33:18 +0000
treeherdermozilla-central@44aac6fc3352 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbzbarsky
bugs1573419
milestone70.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1573419 - Fix assertion failure finalizing JSObjects during shutdown r=bzbarsky The problem is that if there is a leak at shutdown we can end up calling ClearWrapper on a wrapper that has already been cleared by the JS engine. The patch just relaxes the assertion to allow this. I tested this on try with a bunch of retriggers and it seems to fix the problem. Differential Revision: https://phabricator.services.mozilla.com/D41938
dom/bindings/BindingUtils.h
--- a/dom/bindings/BindingUtils.h
+++ b/dom/bindings/BindingUtils.h
@@ -1383,17 +1383,18 @@ inline void ClearWrapper(T* p, nsWrapper
   // Skip clearing the wrapper when replaying. This method is called during
   // finalization of |obj|, and when replaying a strong reference is kept on
   // the contents of the cache: since |obj| is being finalized, the cache
   // cannot point to |obj|, and clearing here won't do anything.
   // Additionally, the reference held on the cache may have already been
   // released, if we are finalizing later than we did while recording, and the
   // cache may have already been deleted.
   if (!recordreplay::IsReplaying()) {
-    MOZ_ASSERT(cache->GetWrapperMaybeDead() == obj);
+    MOZ_ASSERT(cache->GetWrapperMaybeDead() == obj ||
+               (js::RuntimeIsBeingDestroyed() && !cache->GetWrapperMaybeDead()));
     cache->ClearWrapper(obj);
   }
 }
 
 template <class T>
 inline void ClearWrapper(T* p, void*, JSObject* obj) {
   // QueryInterface to nsWrapperCache can't GC, we hope.
   JS::AutoSuppressGCAnalysis nogc;