Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unions containing objects and primitive types are broken when converting from a JS value #17011

Closed
jdm opened this issue May 23, 2017 · 3 comments
Closed

Comments

@jdm
Copy link
Member

@jdm jdm commented May 23, 2017

The FromJSValConvertible implementation for StringOrObject (from FileReader.webidl) has this:

        if value.get().is_object() {

        }

        match StringOrObject::TryConvertToString(cx, value) {
            Err(_) => return Err(()),
            Ok(Some(value)) => return Ok(ConversionResult::Success(StringOrObject::String(value))),
            Ok(None) => (),
        }


        throw_not_in_union(cx, "Object");
        Err(())
@jdm jdm changed the title Unions containing objects are broken Unions containing objects and primitive types are broken May 23, 2017
@jdm jdm changed the title Unions containing objects and primitive types are broken Unions containing objects and primitive types are broken when converting from a JS value May 23, 2017
@jdm
Copy link
Member Author

@jdm jdm commented May 23, 2017

This is the hasObjectTypes branch in CGUnionStructs.

@Xanewok
Copy link
Contributor

@Xanewok Xanewok commented Jan 3, 2018

From recent conversation on IRC with @jdm:

xanewok: yeah, I think we need to make a choice about whether to always generate a single type that only contains values that root themselves, or a single type that must always itself be rooted (and contains values that should only be contained inside of a rooted value), or multiple types to allow both

while I was trying to write out an example of the first option, I realized that I couldn't even figure out how to do that for "only contains values that root themselves" when that includes any or object values

so we probably want something like: #[must_root] enum Something { A(JS), B(Box<Heap>) } for "a single type that must always itself be rooted"

which would then be used with a CustomAutoRooter

same with dictionary values
...
yeah, going for unrooted members and marking the outermost type as must_root is the most workable strategy, I think

This will probably require similar work as in #19644.

@jdm if in #16678 (comment) we can hold only raw gc pointers in sequence case, if the type is used with CustomAutoRooter, can't we store raw gc thing pointers inside the union enum as well?

@jdm
Copy link
Member Author

@jdm jdm commented Jan 3, 2018

The answer is both yes and no. It would be safe to have code like:

enum FooUnion {
    A(JSVal),
    B(Vec<JSVal>),
}

if the value is always used inside CustomAutoRooter<FooUnion>.

Interestingly, adding #[must_root] would provide a false sense of security here, because if we stored the FooUnion value directly inside of a heap-allocated structure (for example, in a DOM object member) then we should be storing the JS values in Heap<JSVal> in that case.

Xanewok added a commit to Xanewok/servo that referenced this issue Mar 10, 2018
Xanewok added a commit to Xanewok/servo that referenced this issue Mar 10, 2018
@Xanewok Xanewok mentioned this issue Mar 10, 2018
2 of 5 tasks complete
Xanewok added a commit to Xanewok/servo that referenced this issue Mar 12, 2018
Xanewok added a commit to Xanewok/servo that referenced this issue Mar 12, 2018
Xanewok added a commit to Xanewok/servo that referenced this issue Mar 13, 2018
Xanewok added a commit to Xanewok/servo that referenced this issue Mar 13, 2018
Xanewok added a commit to Xanewok/servo that referenced this issue Mar 13, 2018
bors-servo added a commit that referenced this issue Mar 14, 2018
Fix JS object conversion in unions

<!-- Please describe your changes on the following line: -->
Requires safe `Heap::boxed` constructor from servo/rust-mozjs#395 (more info on it is in the PR).

Since unions currently assume that their respective members root themselves and can be stored on heap, I modified the union member object conversion branch to convert to a `RootedTraceableBox<Heap<*mut JSObject>>` (which is the currently generated type for objects in said unions).

I did it only for Unions and not dictionaries, since some dictionaries had bare `*mut JSObject` members - is this a mistake and something that needs further fixing?

Does this need a test, e.g. passing a union with object to a function that returns said object, and comparing the results for equality?

r? @jdm

Generated code with this patch (for `StringOrObject`):
```rust
impl FromJSValConvertible for StringOrObject {
    type Config = ();
    unsafe fn from_jsval(cx: *mut JSContext,
                         value: HandleValue,
                         _option: ())
                         -> Result<ConversionResult<StringOrObject>, ()> {
        if value.get().is_object() {
            match StringOrObject::TryConvertToObject(cx, value) {
                Err(_) => return Err(()),
                Ok(Some(value)) => return Ok(ConversionResult::Success(StringOrObject::Object(value))),
                Ok(None) => (),
            }

        }
        // (...)
    }
}

impl StringOrObject {
    // (...)
    unsafe fn TryConvertToObject(cx: *mut JSContext, value: HandleValue) -> Result<Option<RootedTraceableBox<Heap<*mut JSObject>>>, ()> {
        Ok(Some(RootedTraceableBox::from_box(Heap::boxed(value.get().to_object()))))
    }
}
```

---
<!-- Thank you for contributing to Servo! Please replace each `[ ]` by `[X]` when the step is complete, and replace `__` with appropriate data: -->
- [X] `./mach build -d` does not report any errors
- [X] `./mach test-tidy` does not report any errors
- [ ] These changes fix #17011 (github issue number if applicable).

<!-- Either: -->
- [ ] There are tests for these changes OR
- [ ] These changes do not require tests because _____

<!-- Also, please make sure that "Allow edits from maintainers" checkbox is checked, so that we can help you if you get stuck somewhere along the way.-->

<!-- Pull requests that do not address these steps are welcome, but they will require additional verification as part of the review process. -->

<!-- Reviewable:start -->
---
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/20265)
<!-- Reviewable:end -->
bors-servo added a commit that referenced this issue Mar 14, 2018
Fix JS object conversion in unions

<!-- Please describe your changes on the following line: -->
Requires safe `Heap::boxed` constructor from servo/rust-mozjs#395 (more info on it is in the PR).

Since unions currently assume that their respective members root themselves and can be stored on heap, I modified the union member object conversion branch to convert to a `RootedTraceableBox<Heap<*mut JSObject>>` (which is the currently generated type for objects in said unions).

I did it only for Unions and not dictionaries, since some dictionaries had bare `*mut JSObject` members - is this a mistake and something that needs further fixing?

Does this need a test, e.g. passing a union with object to a function that returns said object, and comparing the results for equality?

r? @jdm

Generated code with this patch (for `StringOrObject`):
```rust
impl FromJSValConvertible for StringOrObject {
    type Config = ();
    unsafe fn from_jsval(cx: *mut JSContext,
                         value: HandleValue,
                         _option: ())
                         -> Result<ConversionResult<StringOrObject>, ()> {
        if value.get().is_object() {
            match StringOrObject::TryConvertToObject(cx, value) {
                Err(_) => return Err(()),
                Ok(Some(value)) => return Ok(ConversionResult::Success(StringOrObject::Object(value))),
                Ok(None) => (),
            }

        }
        // (...)
    }
}

impl StringOrObject {
    // (...)
    unsafe fn TryConvertToObject(cx: *mut JSContext, value: HandleValue) -> Result<Option<RootedTraceableBox<Heap<*mut JSObject>>>, ()> {
        Ok(Some(RootedTraceableBox::from_box(Heap::boxed(value.get().to_object()))))
    }
}
```

---
<!-- Thank you for contributing to Servo! Please replace each `[ ]` by `[X]` when the step is complete, and replace `__` with appropriate data: -->
- [X] `./mach build -d` does not report any errors
- [X] `./mach test-tidy` does not report any errors
- [ ] These changes fix #17011 (github issue number if applicable).

<!-- Either: -->
- [ ] There are tests for these changes OR
- [ ] These changes do not require tests because _____

<!-- Also, please make sure that "Allow edits from maintainers" checkbox is checked, so that we can help you if you get stuck somewhere along the way.-->

<!-- Pull requests that do not address these steps are welcome, but they will require additional verification as part of the review process. -->

<!-- Reviewable:start -->
---
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/20265)
<!-- Reviewable:end -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

2 participants
You can’t perform that action at this time.