ladybird icon indicating copy to clipboard operation
ladybird copied to clipboard
Published 3 weeks ago • verified publisher icon LadybirdBrowser

LibJS: Add missing internal object string printing for debugging

Open rcorsi opened this issue 3 months ago • 11 comments

When compiled with ENABLE_ALL_THE_DEBUG_MACROS=ON (or some other specific LibJS X_DEBUG variables) and the test-js is run, the following backtrace will be seen:

(see #6173 where this all started)

VERIFICATION FAILED: false at /home/bobo/projects/myladybird/Libraries/LibJS/Runtime/Value.cpp:396
/home/bobo/projects/myladybird/Build/release/lib/liblagom-ak.so.0(dump_backtrace+0x4a) [0x7b5c5c7354fa]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-ak.so.0(ak_trap+0xf) [0x7b5c5c73575f]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-ak.so.0(ak_verification_failed+0x49) [0x7b5c5c735499]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::Value::to_string_without_side_effects() const 0x30d) [0x7b5c5ccc537d]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::Bytecode::Interpreter::run_executable(JS::Bytecode::Executable&, AK::Optional<unsigned long>, JS::Value) 0x2e9) [0x7b5c5c95c1b9]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::ECMAScriptFunctionObject::internal_call(JS::ExecutionContext&, JS::Value) 0x214) [0x7b5c5ca86494]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0(+0x153b9a) [0x7b5c5c953b9a]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0(+0x154419) [0x7b5c5c954419]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::Bytecode::Interpreter::run_bytecode(unsigned long) 0xee9) [0x7b5c5c958e59]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::Bytecode::Interpreter::run_executable(JS::Bytecode::Executable&, AK::Optional<unsigned long>, JS::Value) 0x24b) [0x7b5c5c95c11b]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::ECMAScriptFunctionObject::internal_call(JS::ExecutionContext&, JS::Value) 0x214) [0x7b5c5ca86494]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0(+0x153b9a) [0x7b5c5c953b9a]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0(+0x154419) [0x7b5c5c954419]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::Bytecode::Interpreter::run_bytecode(unsigned long) 0xee9) [0x7b5c5c958e59]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::Bytecode::Interpreter::run_executable(JS::Bytecode::Executable&, AK::Optional<unsigned long>, JS::Value) 0x24b) [0x7b5c5c95c11b]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::ECMAScriptFunctionObject::internal_call(JS::ExecutionContext&, JS::Value) 0x214) [0x7b5c5ca86494]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0(+0x153b9a) [0x7b5c5c953b9a]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0(+0x154419) [0x7b5c5c954419]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::Bytecode::Interpreter::run_bytecode(unsigned long) 0xee9) [0x7b5c5c958e59]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::Bytecode::Interpreter::run_executable(JS::Bytecode::Executable&, AK::Optional<unsigned long>, JS::Value) 0x24b) [0x7b5c5c95c11b]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::ECMAScriptFunctionObject::internal_call(JS::ExecutionContext&, JS::Value) 0x214) [0x7b5c5ca86494]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0(+0x153b9a) [0x7b5c5c953b9a]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0(+0x154419) [0x7b5c5c954419]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::Bytecode::Interpreter::run_bytecode(unsigned long) 0xee9) [0x7b5c5c958e59]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::Bytecode::Interpreter::run_executable(JS::Bytecode::Executable&, AK::Optional<unsigned long>, JS::Value) 0x24b) [0x7b5c5c95c11b]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::ECMAScriptFunctionObject::internal_call(JS::ExecutionContext&, JS::Value) 0x214) [0x7b5c5ca86494]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0(+0x153b9a) [0x7b5c5c953b9a]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0(+0x154419) [0x7b5c5c954419]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::Bytecode::Interpreter::run_bytecode(unsigned long) 0xee9) [0x7b5c5c958e59]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::Bytecode::Interpreter::run_executable(JS::Bytecode::Executable&, AK::Optional<unsigned long>, JS::Value) 0x24b) [0x7b5c5c95c11b]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::ECMAScriptFunctionObject::internal_call(JS::ExecutionContext&, JS::Value) 0x214) [0x7b5c5ca86494]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0(+0x153b9a) [0x7b5c5c953b9a]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0(+0x154419) [0x7b5c5c954419]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::Bytecode::Interpreter::run_bytecode(unsigned long) 0xee9) [0x7b5c5c958e59]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::Bytecode::Interpreter::run_executable(JS::Bytecode::Executable&, AK::Optional<unsigned long>, JS::Value) 0x24b) [0x7b5c5c95c11b]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::ECMAScriptFunctionObject::internal_call(JS::ExecutionContext&, JS::Value) 0x214) [0x7b5c5ca86494]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0(+0x153b9a) [0x7b5c5c953b9a]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0(+0x154419) [0x7b5c5c954419]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::Bytecode::Interpreter::run_bytecode(unsigned long) 0xee9) [0x7b5c5c958e59]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::Bytecode::Interpreter::run_executable(JS::Bytecode::Executable&, AK::Optional<unsigned long>, JS::Value) 0x24b) [0x7b5c5c95c11b]
/home/bobo/projects/myladybird/Build/release/lib/liblagom-js.so.0 JS::Bytecode::Interpreter::run(JS::Script&, GC::Ptr<JS::Environment>) 0x1fe) [0x7b5c5c95cc0e]
/home/bobo/projects/myladybird/Build/release/bin/test-js(+0x160f2) [0x6070e62d10f2]
/home/bobo/projects/myladybird/Build/release/bin/test-js(+0x14e51) [0x6070e62cfe51]
/home/bobo/projects/myladybird/Build/release/bin/test-js(+0x870a) [0x6070e62c370a]
/lib/x86_64-linux-gnu/libc.so.6(+0x2a578) [0x7b5c5c02a578]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x8b) [0x7b5c5c02a63b]
/home/bobo/projects/myladybird/Build/release/bin/test-js(+0x9025) [0x6070e62c4025]

Cause of the issue in JS::Value::to_string_without_side_effects() is that the m_value.tag in the switch statement does not match any of the cases and goes to the default having the VERIFY_NOT_REACHED() call.

Value of m_value.tag that causes the issue is int 65528 or with 16 bit binary value of: 11111111_11111000 (#FFF8)

Based on that value it appears to have the same value as GC::IS_CELL_PATTERN, but is it really that. I don't completely understand how the encoding is happening, but hope someone can help clarify the situation.

I added a case to the switch to allow GC::IS_CELL_PATTERN, and the issue appears resolved.

Checking the test-js output there are 34714 of these FFF8 cell pattern value, so what are they: NaN or pointer with value 000 or some garbage or something else?

rcorsi avatar Sep 21 '25 23:09 rcorsi

To get the test-js to complete without issues the #6264 patch has to also be applied.

rcorsi avatar Sep 21 '25 23:09 rcorsi

@awesomekling or @trflynn89 know you guys are really busy, but would you be so kind as to review this change?!

rcorsi avatar Sep 22 '25 00:09 rcorsi

Based on the backtrace, the call to the to_string_without_side_effects() is coming from:

Libraries/LibJS/Bytecode/Interpreter.cpp:740

And JS_BYTECODE_DEBUG is the specific debug macro involved in this issue.

rcorsi avatar Sep 22 '25 01:09 rcorsi

that’s possibly an IterationRecord, GeneratorResult or other custom pointer objects that are stored on heap (there are few of these). you could probably go with <unknown> or <internal>, <exotic> etc., try to find a better name here (you could also introduce a new tag for such values and handle it explicitly, but probably keeping the subtag at zero value is also a thing and whole thing was devised this way.)

konradekk avatar Sep 22 '25 12:09 konradekk

@konradekk thank you for your feedback. I'm going to work a little more on it to try to get some actual code examples of the issue. I already found one and will hopefully have some time soon to do a good dive into this.

rcorsi avatar Sep 25 '25 02:09 rcorsi

Running test-js with the new is_cell() check in the latest commit provides the name of the classes at the source of this issue.

Here are the log counts of the two cell types found in the output of test-js:

  23118 [cell CompletionCell]
  17369 [cell GeneratorResult]

So @konradekk you were almost perfect on the actual types.

I also checked test-web and the same cell types were found:

 147761 [cell CompletionCell]
 234326 [cell GeneratorResult]

Is there anything special about these two types in Ladybird?

If I try to understand what is going on with "cell" type, it leads me to search for the GC_CELL macro (defined in Libraries/LibGC/Cell.h) and I get this long list of potential cell types. Should we be seeing them in this new is_cell() output, or are they covered by some other type, like Object, Array, Function, PrimitiveString, RegExpObject, or something else?!

GC_CELL(AccessibilityTreeNode, JS::Cell);      
GC_CELL(Accessor, Cell);      
GC_CELL(ActionExecutor, JS::Cell);      
GC_CELL(AlreadyResolved, Cell);      
GC_CELL(AnimatedBitmapDecodedImageData, DecodedImageData);      
GC_CELL(AnimationFrameCallbackDriver, JS::Cell);      
GC_CELL(ArrayBufferView, BufferableObjectBase);      
GC_CELL(AudioBox, ReplacedBox);      
GC_CELL(AudioPaintable, MediaPaintable);      
GC_CELL(BackingStoreManager, JS::Cell);      
GC_CELL(BaseUriDirective, Directive)      
GC_CELL(BasicFilteredResponse, FilteredResponse);      
GC_CELL(BigInt, Cell);      
GC_CELL(BlockContainer, Box);      
GC_CELL(Body, JS::Cell);      
GC_CELL(Box, NodeWithStyleAndBoxModelMetrics);      
GC_CELL(BreakNode, NodeWithStyleAndBoxModelMetrics);      
GC_CELL(BrowsingContextGroup, JS::Cell);      
GC_CELL(BrowsingContext, JS::Cell);      
GC_CELL(BufferableObjectBase, JS::Cell);      
GC_CELL(BufferSource, BufferableObjectBase);      
GC_CELL(BYOBReaderReadIntoRequest, ReadIntoRequest);      
GC_CELL(CachedSourceRange, GC::Cell);      
GC_CELL(CallbackType, JS::Cell);      
GC_CELL(CanvasBox, ReplacedBox);      
GC_CELL(CanvasPaintable, PaintableBox);      
GC_CELL(CapturedElement, JS::Cell)      
GC_CELL(CascadedProperties, JS::Cell);      
GC_CELL(Cell, GC::Cell);      
GC_CELL(ChangingNavigableContinuationState, JS::Cell);      
GC_CELL(CheckBox, FormAssociatedLabelableNode);      
GC_CELL(CheckBoxPaintable, LabelablePaintable);      
GC_CELL(ChildSourceDirective, Directive)      
GC_CELL(class_, base_class) \     
GC_CELL(ClassicScript, Script);      
GC_CELL(CompletionCell, Cell);      
GC_CELL(ComputedProperties, JS::Cell);      
GC_CELL(ConnectionCloseState, GC::Cell);      
GC_CELL(ConnectSourceDirective, Directive)      
GC_CELL(Console, Cell);      
GC_CELL(ConsoleClient, Cell);      
GC_CELL(CORSFilteredResponse, FilteredResponse);      
GC_CELL(CustomElementDefinition, JS::Cell);      
GC_CELL(CyclicModule, Module);      
GC_CELL(DecodedImageData, JS::Cell);      
GC_CELL(DefaultReaderReadRequest, ReadRequest);      
GC_CELL(DefaultSourceDirective, Directive)      
GC_CELL(Directive, GC::Cell)      
GC_CELL(DocumentDestructionState, GC::Cell);      
GC_CELL(DocumentState, JS::Cell);      
GC_CELL(DOMEventListener, JS::Cell);      
GC_CELL(EditingHostManager, JS::Cell);      
GC_CELL(Environment, Cell);      
GC_CELL(Environment, JS::Cell);      
GC_CELL(EnvironmentSettingsObject, Environment);      
GC_CELL(EnvironmentSettingsSnapshot, EnvironmentSettingsObject);      
GC_CELL(EventHandler, JS::Cell);      
GC_CELL(EventLoop, JS::Cell);      
GC_CELL(Executable, Cell);      
GC_CELL(ExecutionContextRareData, GC::Cell);      
GC_CELL(FetchAlgorithms, JS::Cell);      
GC_CELL(FetchContext, JS::GraphLoadingState::HostDefined);      
GC_CELL(FetchControllerHolder, JS::Cell);      
GC_CELL(FetchController, JS::Cell);      
GC_CELL(FetchedDataReceiver, JS::Cell);      
GC_CELL(FetchParams, JS::Cell);      
GC_CELL(FetchRecord, JS::Cell);      
GC_CELL(FetchTimingInfo, JS::Cell);      
GC_CELL(FieldSetBox, BlockContainer);      
GC_CELL(FieldSetPaintable, PaintableBox);      
GC_CELL(FilteredResponse, Response);      
GC_CELL(FlatMapIterator, Cell);      
GC_CELL(FontLoader, GC::Cell);      
GC_CELL(FontSourceDirective, Directive)      
GC_CELL(FormActionDirective, Directive)      
GC_CELL(FormAssociatedLabelableNode, LabelableNode);      
GC_CELL(FrameAncestorsDirective, Directive)      
GC_CELL(FrameSourceDirective, Directive)      
GC_CELL(FreelistEntry, Cell);      
GC_CELL(Function, Cell);      
GC_CELL(GeneratedContentImageProvider, GC::Cell);      
GC_CELL(GeneratorResult, Cell);      
GC_CELL(GraphLoadingState, Cell);      
GC_CELL(HeaderList, JS::Cell);      
GC_CELL(HeapTimer, JS::Cell);      
GC_CELL(HostDefined, Cell);      
GC_CELL(HTMLParser, JS::Cell);      
GC_CELL(IDBDatabaseObserver, GC::Cell);      
GC_CELL(IDBRequestObserver, GC::Cell);      
GC_CELL(IDBTransactionObserver, GC::Cell);      
GC_CELL(ImageBox, ReplacedBox);      
GC_CELL(ImagePaintable, PaintableBox);      
GC_CELL(ImageRequest, JS::Cell);      
GC_CELL(ImageSourceDirective, Directive)      
GC_CELL(ImportMapParseResult, JS::Cell);      
GC_CELL(IncrementalReadLoopReadRequest, Streams::ReadRequest);      
GC_CELL(Index, JS::Cell);      
GC_CELL(InlineNode, NodeWithStyleAndBoxModelMetrics);      
GC_CELL(Intrinsics, Cell);      
GC_CELL(Intrinsics, JS::Cell);      
GC_CELL(IteratorRecord, Cell);      
GC_CELL(JavaScriptModuleScript, ModuleScript);      
GC_CELL(JobCallback, JS::Cell);      
GC_CELL(Job, JS::Cell)      
GC_CELL(Key, JS::Cell);      
GC_CELL(LabelableNode, ReplacedBox);      
GC_CELL(LabelablePaintable, PaintableBox);      
GC_CELL(Label, BlockContainer);      
GC_CELL(LegendBox, BlockContainer);      
GC_CELL(ListItemBox, BlockContainer);      
GC_CELL(ListItemMarkerBox, Box);      
GC_CELL(ListOfAvailableImages, JS::Cell);      
GC_CELL(LocalStorageBottle, StorageBottle);      
GC_CELL(ManifestSourceDirective, Directive)      
GC_CELL(MarkerPaintable, PaintableBox);      
GC_CELL(MediaPaintable, PaintableBox);      
GC_CELL(MediaSourceDirective, Directive)      
GC_CELL(Module, Cell);      
GC_CELL(ModuleMap, JS::Cell);      
GC_CELL(ModuleScript, Script);      
GC_CELL(NamedViewTransitionPseudoElement, DOM::PseudoElementTreeNode);      
GC_CELL(NavigableContainerViewportPaintable, PaintableBox);      
GC_CELL(NavigableContainerViewport, ReplacedBox);      
GC_CELL(Navigable, JS::Cell);      
GC_CELL(NavigationAPIMethodTracker, JS::Cell);      
GC_CELL(NavigationParams, GC::Cell);      
GC_CELL(Node, JS::Cell);      
GC_CELL(NodeWithStyleAndBoxModelMetrics, NodeWithStyle);      
GC_CELL(NodeWithStyle, Node);      
GC_CELL(NonFetchSchemeNavigationParams, JS::Cell);      
GC_CELL(Object, Cell);      
GC_CELL(ObjectSourceDirective, Directive)      
GC_CELL(ObjectStore, JS::Cell);      
GC_CELL(OpaqueFilteredResponse, FilteredResponse);      
GC_CELL(OpaqueRedirectFilteredResponse, FilteredResponse);      
GC_CELL(PageClient, JS::Cell);      
GC_CELL(Page, JS::Cell);      
GC_CELL(PaintableBox, Paintable);      
GC_CELL(Paintable, JS::Cell);      
GC_CELL(PaintableWithLines, PaintableBox);      
GC_CELL(PendingRequestProcess, GC::Cell);      
GC_CELL(PendingResponse, JS::Cell);      
GC_CELL(PolicyContainer, GC::Cell)      
GC_CELL(Policy, GC::Cell);      
GC_CELL(PolicyList, GC::Cell);      
GC_CELL(Position, JS::Cell);      
GC_CELL(PrimitiveString, Cell);      
GC_CELL(PrivateEnvironment, Cell);      
GC_CELL(PromiseCapability, Cell);      
GC_CELL(PromiseHolder, JS::Cell);      
GC_CELL(PromiseReaction, Cell);      
GC_CELL(PromiseValueList, Cell);      
GC_CELL(PrototypeChainValidity, Cell);      
GC_CELL(PseudoElement, JS::Cell);      
GC_CELL(PseudoElementTreeNode, PseudoElement);      
GC_CELL(PullIntoDescriptor, GC::Cell);      
GC_CELL(RadioButton, FormAssociatedLabelableNode);      
GC_CELL(RadioButtonPaintable, LabelablePaintable);      
GC_CELL(ReadableByteStreamTeeBYOBReadRequest, ReadIntoRequest);      
GC_CELL(ReadableByteStreamTeeDefaultReadRequest, ReadRequest);      
GC_CELL(ReadableByteStreamTeeParams, JS::Cell);      
GC_CELL(ReadableStreamAsyncIteratorReadRequest, ReadRequest);      
GC_CELL(ReadableStreamPipeTo, JS::Cell);      
GC_CELL(ReadableStreamPipeToReadRequest, ReadRequest);      
GC_CELL(ReadableStreamTeeParams, JS::Cell);      
GC_CELL(ReadableStreamTeeReadRequest, ReadRequest);      
GC_CELL(ReadIntoRequest, JS::Cell);      
GC_CELL(ReadLoopReadRequest, ReadRequest);      
GC_CELL(ReadRequest, JS::Cell);      
GC_CELL(Realm, Cell);      
GC_CELL(RegisteredObserver, JS::Cell);      
GC_CELL(RemainingElements, Cell);      
GC_CELL(ReplacedBox, Box);      
GC_CELL(ReplacedNamedViewTransitionPseudoElement, NamedViewTransitionPseudoElement);      
GC_CELL(ReportToDirective, Directive)      
GC_CELL(ReportUriDirective, Directive)      
GC_CELL(Request, JS::Cell);      
GC_CELL(RequireTrustedTypesForDirective, ContentSecurityPolicy::Directives::Directive)      
GC_CELL(ResizeObservation, JS::Cell);      
GC_CELL(ResolvingFunctions, Cell);      
GC_CELL(ResponseHolder, JS::Cell);      
GC_CELL(Response, JS::Cell);      
GC_CELL(RopeString, PrimitiveString);      
GC_CELL(SandboxDirective, Directive)      
GC_CELL(Script, Cell);      
GC_CELL(Script, JS::Cell);      
GC_CELL(ScriptSourceAttributeDirective, Directive)      
GC_CELL(ScriptSourceDirective, Directive)      
GC_CELL(ScriptSourceElementDirective, Directive)      
GC_CELL(SessionHistoryEntry, JS::Cell);      
GC_CELL(SessionHistoryTraversalQueueEntry, JS::Cell);      
GC_CELL(SessionHistoryTraversalQueue, JS::Cell);      
GC_CELL(SessionStorageBottle, StorageBottle);      
GC_CELL(Shape, Cell);      
GC_CELL(SharedFunctionInstanceData, GC::Cell);      
GC_CELL(SharedResourceRequest, JS::Cell);      
GC_CELL(SourceElementSelector, JS::Cell);      
GC_CELL(SourceSnapshotParams, GC::Cell)      
GC_CELL(SourceTextModule, CyclicModule);      
GC_CELL(StorageBottle, GC::Cell);      
GC_CELL(StorageBucket, GC::Cell);      
GC_CELL(StorageShed, GC::Cell);      
GC_CELL(StorageShelf, GC::Cell);      
GC_CELL(StyleComputer, GC::Cell);      
GC_CELL(StyleInvalidator, GC::Cell);      
GC_CELL(StyleSourceAttributeDirective, Directive)      
GC_CELL(StyleSourceDirective, Directive)      
GC_CELL(StyleSourceElementDirective, Directive)      
GC_CELL(SVGBox, Box);      
GC_CELL(SVGClipBox, SVGBox);      
GC_CELL(SVGClipPaintable, SVGPaintable);      
GC_CELL(SVGDecodedImageData, HTML::DecodedImageData);      
GC_CELL(SVGDecodedImageData::SVGPageClient, PageClient);      
GC_CELL(SVGForeignObjectBox, BlockContainer);      
GC_CELL(SVGForeignObjectPaintable, PaintableWithLines);      
GC_CELL(SVGGeometryBox, SVGGraphicsBox);      
GC_CELL(SVGGraphicsBox, SVGBox);      
GC_CELL(SVGGraphicsPaintable, SVGPaintable);      
GC_CELL(SVGImageBox, SVGGraphicsBox);      
GC_CELL(SVGMaskBox, SVGGraphicsBox);      
GC_CELL(SVGMaskPaintable, SVGGraphicsPaintable);      
GC_CELL(SVGPaintable, PaintableBox);      
GC_CELL(SVGPathPaintable, SVGGraphicsPaintable);      
GC_CELL(SVGSVGBox, ReplacedBox);      
GC_CELL(SVGSVGPaintable, PaintableBox);      
GC_CELL(SVGTextBox, SVGGraphicsBox);      
GC_CELL(SVGTextPathBox, SVGGraphicsBox);      
GC_CELL(Symbol, Cell);      
GC_CELL(SyntheticModule, Module);      
GC_CELL(TableWrapper, BlockContainer);      
GC_CELL(TaskCounterState, GC::Cell);      
GC_CELL(Task, JS::Cell);      
GC_CELL(TaskQueue, JS::Cell);      
GC_CELL(TextNode, Node);      
GC_CELL(TextPaintable, Paintable);      
GC_CELL(Timer, JS::Cell);      
GC_CELL(Timer, JS::Cell);      
GC_CELL(TimerSerenity, Timer);      
GC_CELL(TransactionFinishState, GC::Cell);      
GC_CELL(TransientRegisteredObserver, RegisteredObserver);      
GC_CELL(TraversableNavigable, Navigable);      
GC_CELL(UpdateAlgorithmState, JS::Cell);      
GC_CELL(VideoBox, ReplacedBox);      
GC_CELL(VideoPaintable, MediaPaintable);      
GC_CELL(Viewport, BlockContainer);      
GC_CELL(ViewportPaintable, PaintableWithLines);      
GC_CELL(Violation, JS::Cell);      
GC_CELL(WaitForAllResults, JS::Cell);      
GC_CELL(WebRTCDirective, Directive)      
GC_CELL(WindowEnvironmentSettingsObject, EnvironmentSettingsObject);      
GC_CELL(WorkerAgentParent, JS::Cell);      
GC_CELL(WorkerDebugConsoleClient, JS::ConsoleClient);      
GC_CELL(WorkerEnvironmentSettingsObject, EnvironmentSettingsObject);      
GC_CELL(WorkerSourceDirective, Directive)

rcorsi avatar Nov 05 '25 03:11 rcorsi

Hello!

One or more of the commit messages in this PR do not match the Ladybird code submission policy, please check the lint_commits CI job for more details on which commits were flagged and why. Please do not close this PR and open another, instead modify your commit message(s) with git commit --amend and force push those changes to update this PR.

ladybird-bot avatar Nov 16 '25 21:11 ladybird-bot

I did some digging and found these four internal objects when running the test-web program.

CompletionCell
DeclarativeEnvironment
GeneratorResult
PromiseCapability

I can see that CompletionCell and GeneratorResult work together to support Generator functions. These help manage the generator's execution context.

DeclarativeEnvironment is responsible for binding identifiers to their corresponding values within a specific scope. I see the Global scope mentioned a lot, but might also relate to local or function scope. At Libraries/LibJS/Bytecode/Interpreter.cpp:2432 an Environment object is used, this seems to be a "sub-class" I'm guessing.

PromiseCapability is a value used to encapsulate a Promise or promise-like object along with the functions that are capable of resolving or rejecting that promise.

These all sound like internal states, so as one of @konradekk suggestions I decided to call these unknown cells as "internal object".

Hope this latest change is the right one.

rcorsi avatar Nov 17 '25 04:11 rcorsi

@gmta Could you please have a look at this PR to give me some feedback. There is this issue and a new one I just opened #6948 that are detected by the All_Debug profile when test is run.

rcorsi avatar Nov 27 '25 04:11 rcorsi

@rcorsi Not sure why you are pinging me? We have #code-review or #js on Discord to try to get the attention of maintainers. I'm not particularly knowledgeable in this area.

gmta avatar Nov 27 '25 08:11 gmta

@rcorsi Not sure why you are pinging me? We have #code-review or #js on Discord to try to get the attention of maintainers. I'm not particularly knowledgeable in this area.

@gmta Sorry about spamming you. Was going to give up on this one as I've had this open for a while and I only had one comment.

rcorsi avatar Nov 27 '25 15:11 rcorsi