CloseMessagePortTimer retains MessagePort, but not its wrapper. As a result, event listeners can be garbage collected, and the close event will be dispatched using a stale listener object pointer. Patch forthcoming.
Created attachment 23908 [details] proposed fix It seems really ugly to control JS garbage collection from DOM code (if anything, this will fail when we enable non-JS bindings for MessageChannel/MessagePort), but looks like we don't have another mechanism.
(In reply to comment #1) > It seems really ugly to control JS garbage collection from DOM code (if > anything, this will fail when we enable non-JS bindings for > MessageChannel/MessagePort), but looks like we don't have another mechanism. I think we need to come up with a general way to tell the bindings that an object is "active" and therefore should not be subject to garbage collection until it becomes inactive. On the other hand, that doesn't seem much different from an explicit call to gcProtect, except for being a bit more language-independent. It would be a bit more elegant to make a call to the bindings machinery on the DOM object and let the helper function do the "map to a wrapper and a gcProtect".
Comment on attachment 23908 [details] proposed fix Clearing review flag, going to investigate a better solution.
Created attachment 23937 [details] updated patch
Comment on attachment 23937 [details] updated patch Nice.
Committed revision 37094.