203973 - txXSLTProcessor::shutdown releases a log module it doesn't own

Status: RESOLVED FIXED

(Core :: XSLT, defect)

Description

[timeless]

I'm running w/ a modified xpcom lib which calls PR_Cleanup.

==16646== Invalid read of size 4
==16646==    at 0x404AC8F8: _PR_LogCleanup (/mnt/ibm/mozhack/mozilla/nsprpub/pr/src/io/prlog.c:282)
==16646==    by 0x404D0D3B: PR_Cleanup (/mnt/ibm/mozhack/mozilla/nsprpub/pr/src/pthreads/ptthread.c:928)
==16646==    by 0x4037E294: NS_ShutdownXPCOM (/mnt/ibm/mozhack/mozilla/xpcom/build/nsXPComInit.cpp:789)
==16646==    by 0x804CCDB: main (/mnt/ibm/mozhack/mozilla/js/src/xpconnect/shell/xpcshell.cpp:1010)
==16646==    by 0x4059417D: __libc_start_main (in /lib/libc-2.2.5.so)
==16646==    by 0x804AAB1: (within /mnt/ibm/mozhack/obj-i686-pc-linux-gnu-qt/js/src/xpconnect/shell/xpcshell)
==16646==    Address 0x48661680 is 8 bytes inside a block of size 12 free'd
==16646==    at 0x40046FF6: free (vg_clientfuncs.c:180)
==16646==    by 0x404B4171: PR_Free (/mnt/ibm/mozhack/mozilla/nsprpub/pr/src/malloc/prmem.c:456)
==16646==    by 0x48E8938F: txXSLTProcessor::shutdown(void) (/mnt/ibm/mozhack/mozilla/extensions/transformiix/source/xslt/txXSLTProcessor.cpp:97)
==16646==    by 0x48E0DCCD: Shutdown(nsIModule *) (/mnt/ibm/mozhack/mozilla/extensions/transformiix/build/XSLTProcessorModule.cpp:253)
==16646==    by 0x48E8938F: txXSLTProcessor::shutdown(void) (/mnt/ibm/mozhack/mozilla/extensions/transformiix/source/xslt/txXSLTProcessor.cpp:97)

./run-mozilla.sh ./xpcshell
const C=Components.classes
for (a in C) if (/transformiix/.test(a)) C[a].createInstance()
quit()

Comment 1

[timeless]

Attachment: remove misguided cleanup

Comment 2

[Axel Hecht]

Comment on attachment 122134 [details] [diff] [review]
remove misguided cleanup

not sure how pressing this issue is. but anyway, r=[e-mail].
I suggest coordinating with those working on the module before suggesting
changes all over the place

Comment 3

[timeless]

checked in