Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upUnions containing objects and primitive types are broken when converting from a JS value #17011
Comments
|
This is the |
|
From recent conversation on IRC with @jdm:
This will probably require similar work as in #19644. @jdm if in #16678 (comment) we can hold only raw gc pointers in sequence case, if the type is used with CustomAutoRooter, can't we store raw gc thing pointers inside the union enum as well? |
|
The answer is both yes and no. It would be safe to have code like: enum FooUnion {
A(JSVal),
B(Vec<JSVal>),
}if the value is always used inside Interestingly, adding |
Fix JS object conversion in unions <!-- Please describe your changes on the following line: --> Requires safe `Heap::boxed` constructor from servo/rust-mozjs#395 (more info on it is in the PR). Since unions currently assume that their respective members root themselves and can be stored on heap, I modified the union member object conversion branch to convert to a `RootedTraceableBox<Heap<*mut JSObject>>` (which is the currently generated type for objects in said unions). I did it only for Unions and not dictionaries, since some dictionaries had bare `*mut JSObject` members - is this a mistake and something that needs further fixing? Does this need a test, e.g. passing a union with object to a function that returns said object, and comparing the results for equality? r? @jdm Generated code with this patch (for `StringOrObject`): ```rust impl FromJSValConvertible for StringOrObject { type Config = (); unsafe fn from_jsval(cx: *mut JSContext, value: HandleValue, _option: ()) -> Result<ConversionResult<StringOrObject>, ()> { if value.get().is_object() { match StringOrObject::TryConvertToObject(cx, value) { Err(_) => return Err(()), Ok(Some(value)) => return Ok(ConversionResult::Success(StringOrObject::Object(value))), Ok(None) => (), } } // (...) } } impl StringOrObject { // (...) unsafe fn TryConvertToObject(cx: *mut JSContext, value: HandleValue) -> Result<Option<RootedTraceableBox<Heap<*mut JSObject>>>, ()> { Ok(Some(RootedTraceableBox::from_box(Heap::boxed(value.get().to_object())))) } } ``` --- <!-- Thank you for contributing to Servo! Please replace each `[ ]` by `[X]` when the step is complete, and replace `__` with appropriate data: --> - [X] `./mach build -d` does not report any errors - [X] `./mach test-tidy` does not report any errors - [ ] These changes fix #17011 (github issue number if applicable). <!-- Either: --> - [ ] There are tests for these changes OR - [ ] These changes do not require tests because _____ <!-- Also, please make sure that "Allow edits from maintainers" checkbox is checked, so that we can help you if you get stuck somewhere along the way.--> <!-- Pull requests that do not address these steps are welcome, but they will require additional verification as part of the review process. --> <!-- Reviewable:start --> --- This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/20265) <!-- Reviewable:end -->
Fix JS object conversion in unions <!-- Please describe your changes on the following line: --> Requires safe `Heap::boxed` constructor from servo/rust-mozjs#395 (more info on it is in the PR). Since unions currently assume that their respective members root themselves and can be stored on heap, I modified the union member object conversion branch to convert to a `RootedTraceableBox<Heap<*mut JSObject>>` (which is the currently generated type for objects in said unions). I did it only for Unions and not dictionaries, since some dictionaries had bare `*mut JSObject` members - is this a mistake and something that needs further fixing? Does this need a test, e.g. passing a union with object to a function that returns said object, and comparing the results for equality? r? @jdm Generated code with this patch (for `StringOrObject`): ```rust impl FromJSValConvertible for StringOrObject { type Config = (); unsafe fn from_jsval(cx: *mut JSContext, value: HandleValue, _option: ()) -> Result<ConversionResult<StringOrObject>, ()> { if value.get().is_object() { match StringOrObject::TryConvertToObject(cx, value) { Err(_) => return Err(()), Ok(Some(value)) => return Ok(ConversionResult::Success(StringOrObject::Object(value))), Ok(None) => (), } } // (...) } } impl StringOrObject { // (...) unsafe fn TryConvertToObject(cx: *mut JSContext, value: HandleValue) -> Result<Option<RootedTraceableBox<Heap<*mut JSObject>>>, ()> { Ok(Some(RootedTraceableBox::from_box(Heap::boxed(value.get().to_object())))) } } ``` --- <!-- Thank you for contributing to Servo! Please replace each `[ ]` by `[X]` when the step is complete, and replace `__` with appropriate data: --> - [X] `./mach build -d` does not report any errors - [X] `./mach test-tidy` does not report any errors - [ ] These changes fix #17011 (github issue number if applicable). <!-- Either: --> - [ ] There are tests for these changes OR - [ ] These changes do not require tests because _____ <!-- Also, please make sure that "Allow edits from maintainers" checkbox is checked, so that we can help you if you get stuck somewhere along the way.--> <!-- Pull requests that do not address these steps are welcome, but they will require additional verification as part of the review process. --> <!-- Reviewable:start --> --- This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/20265) <!-- Reviewable:end -->
The FromJSValConvertible implementation for
StringOrObject(from FileReader.webidl) has this: