Issue #2387 - Collection of fixes related to a crash while canceling a dynamic import. Add AddRef/Release hooks for embedding's script or module private value and set this script source object where appropriate. https://bugzilla.mozilla.org/show_bug.cgi?id=1519140 Partial, no Value passing changes. Clear the list of dynamic import requests after cancelling them in ScriptLoader::ParsingComplete as we do for other requests. https://bugzilla.mozilla.org/show_bug.cgi?id=1291535 ScriptLoader::OnStreamComplete never returns a failure. https://bugzilla.mozilla.org/show_bug.cgi?id=1627275 Also cancel the correct kind of parser for Modules.

js/src/builtin/ModuleObject.cpp

@@ -1607,7 +1607,10 @@ js::StartDynamicModuleImport(JSContext* cx, HandleValue referencingPrivate, Hand
 
     JS::ModuleDynamicImportHook importHook = cx->runtime()->moduleDynamicImportHook;
     MOZ_ASSERT(importHook);
+    cx->runtime()->addRefScriptPrivate(referencingPrivate);
     if (!importHook(cx, referencingPrivate, specifier, promise)) {
+        cx->runtime()->releaseScriptPrivate(referencingPrivate);
+
         if (!RejectPromiseWithPendingError(cx, promise))
             return nullptr;
         return promise;
@@ -1622,6 +1625,9 @@ js::FinishDynamicModuleImport(JSContext* cx, HandleValue referencingPrivate, Han
 {
     Handle<PromiseObject*> promise = promiseArg.as<PromiseObject>();
 
+    auto releasePrivate = mozilla::MakeScopeExit(
+        [&] { cx->runtime()->releaseScriptPrivate(referencingPrivate); });
+
     if (cx->isExceptionPending()) {
         return RejectPromiseWithPendingError(cx, promise);
     }

js/src/jsapi.cpp

@@ -4729,7 +4729,8 @@ JS::CompileModule(JSContext* cx, const ReadOnlyCompileOptions& options,
 JS_PUBLIC_API(void)
 JS::SetModulePrivate(JSObject* module, const JS::Value& value)
 {
-    module->as<ModuleObject>().scriptSourceObject()->setPrivate(value);
+    JSRuntime* rt = module->compartment()->runtimeFromMainThread();
+    module->as<ModuleObject>().scriptSourceObject()->setPrivate(rt, value);
 }
 
 JS_PUBLIC_API(JS::Value)
@@ -4741,7 +4742,8 @@ JS::GetModulePrivate(JSObject* module)
 JS_PUBLIC_API(void)
 JS::SetScriptPrivate(JSScript* script, const JS::Value& value)
 {
-    script->scriptSourceUnwrap().setPrivate(value);
+    JSRuntime* rt = script->compartment()->runtimeFromMainThread();
+    script->scriptSourceUnwrap().setPrivate(rt, value);
 }
 
 JS_PUBLIC_API(JS::Value)
@@ -4764,18 +4766,13 @@ JS::GetScriptedCallerPrivate(JSContext* cx)
   return FindScriptOrModulePrivateForScript(iter.script());
 }
 
-JS_PUBLIC_API(JS::ScriptPrivateFinalizeHook)
-JS::GetScriptPrivateFinalizeHook(JSContext* cx) 
-{
-  AssertHeapIsIdle(cx);
-  return cx->runtime()->scriptPrivateFinalizeHook;
-}
-
 JS_PUBLIC_API(void)
-JS::SetScriptPrivateFinalizeHook(JSContext* cx, JS::ScriptPrivateFinalizeHook func)
+JS::SetScriptPrivateReferenceHooks(JSContext* cx, JS::ScriptPrivateReferenceHook addRefHook,
+                                   JS::ScriptPrivateReferenceHook releaseHook)
 {
   AssertHeapIsIdle(cx);
-  cx->runtime()->scriptPrivateFinalizeHook = func;
+  cx->runtime()->scriptPrivateAddRefHook = addRefHook;
+  cx->runtime()->scriptPrivateReleaseHook = releaseHook;
 }
 
 JS_PUBLIC_API(bool)

js/src/jsapi.h

@@ -4432,24 +4432,18 @@ extern JS_PUBLIC_API(JS::Value)
 GetScriptedCallerPrivate(JSContext* cx);
 
 /**
- * A hook that's called whenever a script or module which has a private value
- * set with SetScriptPrivate() or SetModulePrivate() is finalized. This can be
- * used to clean up the private state. The private value is passed as an
- * argument.
+ * Hooks called when references to a script private value are created or
+ * destroyed. This allows use of a reference counted object as the
+ * script private.
  */
-using ScriptPrivateFinalizeHook = void (*)(JSFreeOp*, const JS::Value&);
-
-/**
- * Get the script private finalize hook for the runtime.
- */
-extern JS_PUBLIC_API(ScriptPrivateFinalizeHook)
-GetScriptPrivateFinalizeHook(JSContext* cx);
+using ScriptPrivateReferenceHook = void (*)(const JS::Value&);
 
 /**
  * Set the script private finalize hook for the runtime to the given function.
  */
 extern JS_PUBLIC_API(void)
-SetScriptPrivateFinalizeHook(JSContext* cx, ScriptPrivateFinalizeHook func);
+SetScriptPrivateReferenceHooks(JSContext* cx, ScriptPrivateReferenceHook addRefHook,
+                               ScriptPrivateReferenceHook releaseHook);
 
 /*
  * Perform the ModuleInstantiate operation on the given source text module

js/src/jsscript.cpp

@@ -1419,15 +1419,8 @@ ScriptSourceObject::finalize(FreeOp* fop, JSObject* obj)
     sso->source()->decref();
     sso->setReservedSlot(SOURCE_SLOT, PrivateValue(nullptr));
 
-    Value value = sso->canonicalPrivate();
-    if (!value.isUndefined()) {
-        // The embedding may need to dispose of its private data.
-        JS::AutoSuppressGCAnalysis suppressGC;
-        if (JS::ScriptPrivateFinalizeHook hook =
-            fop->runtime()->scriptPrivateFinalizeHook) {
-                hook(fop, value);
-            }
-    }
+    // Clear the private value, calling the release hook if necessary.
+    sso->setPrivate(fop->runtime(), UndefinedValue());
 }
 
 static const ClassOps ScriptSourceObjectClassOps = {
@@ -1532,6 +1525,25 @@ ScriptSourceObject::initFromOptions(JSContext* cx, HandleScriptSource source,
     return true;
 }
 
+void ScriptSourceObject::setPrivate(JSRuntime* rt, const Value& value)
+{
+  // Update the private value, calling addRef/release hooks if necessary
+  // to allow the embedding to maintain a reference count for the
+  // private data.
+  Value prevValue = getReservedSlot(PRIVATE_SLOT);
+  if (!prevValue.isUndefined()) {
+    if (auto releaseHook = rt->scriptPrivateReleaseHook) {
+      releaseHook(prevValue);
+    }
+  }
+  setReservedSlot(PRIVATE_SLOT, value);
+  if (!value.isUndefined()) {
+    if (auto addRefHook = rt->scriptPrivateAddRefHook) {
+      addRefHook(value);
+    }
+  }
+}
+
 /* static */ bool
 JSScript::loadSource(JSContext* cx, ScriptSource* ss, bool* worked)
 {

js/src/jsscript.h

@@ -675,9 +675,7 @@ class ScriptSourceObject : public NativeObject
         return static_cast<JSScript*>(untyped);
     }
 
-    void setPrivate(const Value& value) {
-        setReservedSlot(PRIVATE_SLOT, value);
-    }
+    void setPrivate(JSRuntime* rt, const Value& value);
 
     Value getPrivate() const {
         return getReservedSlot(PRIVATE_SLOT);

js/src/vm/Runtime.cpp

@@ -252,7 +252,8 @@ JSRuntime::JSRuntime(JSRuntime* parentRuntime)
     moduleResolveHook(),
     moduleMetadataHook(),
     moduleDynamicImportHook(),
-    scriptPrivateFinalizeHook()
+    scriptPrivateAddRefHook(),
+    scriptPrivateReleaseHook()
 {
     setGCStoreBufferPtr(&gc.storeBuffer);
 

js/src/vm/Runtime.h

@@ -1316,8 +1316,21 @@ struct JSRuntime : public JS::shadow::Runtime,
     // HostImportModuleDynamically.
     JS::ModuleDynamicImportHook moduleDynamicImportHook;
 
-    // A hook called on script finalization.
-    JS::ScriptPrivateFinalizeHook scriptPrivateFinalizeHook;
+    // Hooks called when script private references are created and destroyed.
+    JS::ScriptPrivateReferenceHook scriptPrivateAddRefHook;
+    JS::ScriptPrivateReferenceHook scriptPrivateReleaseHook;
+
+    void addRefScriptPrivate(const JS::Value& value) {
+      if (!value.isUndefined() && scriptPrivateAddRefHook) {
+        scriptPrivateAddRefHook(value);
+      }
+    }
+
+    void releaseScriptPrivate(const JS::Value& value) {
+      if (!value.isUndefined() && scriptPrivateReleaseHook) {
+        scriptPrivateReleaseHook(value);
+      }
+    }
 };
 
 namespace js {