301491 - [@ js_LinkFunctionObject]

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[timeless]

found in 18a5, but the code hasn't changed on trunk.

funobj is 0x0 in js_LinkFunctionObject.
funval is destroyed in nsXPCComponents::LookupMethod

the fix is the same as in bug 180182 and bug 289949:
add AUTO_MARK_JSVAL(ccx, funval); between GetValue and JS_CloneFunctionObject

ChildEBP RetAddr  Args to Child              
0012ea50 00b1a032 00a959d8 00000000 02570590 js3250!js_LinkFunctionObject+0x9 
[c:\build\chs3\build\mozilla\js\src\jsfun.c @ 1968]
0012ea70 00b02c86 00a959d8 11c6dc48 0232beb0 js3250!js_CloneFunctionObject+0x34 
[c:\build\chs3\build\mozilla\js\src\jsfun.c @ 1958]
0012ea88 00ad616e 00a959d8 11c6dc48 0232beb0 js3250!JS_CloneFunctionObject+0x57 
[c:\build\chs3\build\mozilla\js\src\jsapi.c @ 3172]
0012eb50 00865004 11c6dc48 0012ed08 00ae357a xpc3250!
nsXPCComponents::LookupMethod+0x1e3 [c:\build\chs3
\build\mozilla\js\src\xpconnect\src\xpccomponents.cpp @ 2096]
0012eb5c 00ae357a 00fd9cb8 0000000e 00000000 xpcom_core!XPTC_InvokeByIndex+0x27 
[c:\build\chs3\build\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp 
@ 102]
0012ed08 00ae5400 0012ed24 00000000 00000000 xpc3250!
XPCWrappedNative::CallMethod+0x6c4 [c:\build\chs3
\build\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp @ 2065]
0012ed9c 00b1d071 00a959d8 00f9b418 00000002 xpc3250!XPC_WN_CallMethod+0x8e 
[c:\build\chs3\build\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp @ 
1287]
0012ee50 00b2246f 00000001 00000002 00000000 js3250!js_Invoke+0x531 
[c:\build\chs3\build\mozilla\js\src\jsinterp.c @ 1320]
0012efb0 00b1d0b2 00a959d8 14d8737e 0012f058 js3250!js_Interpret+0x4b13 
[c:\build\chs3\build\mozilla\js\src\jsinterp.c @ 3612]
0012f05c 00b2246f 00000001 00000001 00000000 js3250!js_Invoke+0x572 
[c:\build\chs3\build\mozilla\js\src\jsinterp.c @ 1340]
0012f1bc 00b1d0b2 00a959d8 13215216 0012f264 js3250!js_Interpret+0x4b13 
[c:\build\chs3\build\mozilla\js\src\jsinterp.c @ 3612]
0012f268 00b2429e 00000001 00000002 00000001 js3250!js_Invoke+0x572 
[c:\build\chs3\build\mozilla\js\src\jsinterp.c @ 1340]
0012f3c8 00b1d0b2 00a959d8 0c6f798b 0012f470 js3250!js_Interpret+0x6942 
[c:\build\chs3\build\mozilla\js\src\jsinterp.c @ 3178]
0012f474 00b2246f 00000001 00000001 00000000 js3250!js_Invoke+0x572 
[c:\build\chs3\build\mozilla\js\src\jsinterp.c @ 1340]
0012f5d4 00b1d0b2 00a959d8 12fa8be8 0012f67c js3250!js_Interpret+0x4b13 
[c:\build\chs3\build\mozilla\js\src\jsinterp.c @ 3612]
0012f680 00b2246f 00000001 00000004 00000000 js3250!js_Invoke+0x572 
[c:\build\chs3\build\mozilla\js\src\jsinterp.c @ 1340]
0012f7e0 00b1d0b2 00a959d8 023cc17a 0012f888 js3250!js_Interpret+0x4b13 
[c:\build\chs3\build\mozilla\js\src\jsinterp.c @ 3612]
0012f88c 00ae0dd2 00000001 00000004 00000002 js3250!js_Invoke+0x572 
[c:\build\chs3\build\mozilla\js\src\jsinterp.c @ 1340]
0012f9f4 00ade4c5 0218a3d0 043cf308 00000003 xpc3250!
nsXPCWrappedJSClass::CallMethod+0x6a4 [c:\build\chs3
\build\mozilla\js\src\xpconnect\src\xpcwrappedjsclass.cpp @ 1339]
0012fa0c 00864526 023cf308 00000003 0216ee70 xpc3250!
nsXPCWrappedJS::CallMethod+0x27 [c:\build\chs3
\build\mozilla\js\src\xpconnect\src\xpcwrappedjs.cpp @ 450]

Comment 1

[timeless]

Attachment: mark the value before it passing it to a function that can cause it to be gc'd

Comment 2

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 189947 [details] [diff] [review]
mark the value before it passing it to a function that can cause it to be gc'd

Are we sure that only one GC can happen under here?

Comment 3

[timeless]

http://lxr.mozilla.org/seamonkey/source/js/src/xpconnect/src/xpcprivate.h#3206

i'm certainly not sure, i kinda presumed the creature was going to protect it
from all js_gc's for the duration of scope (it only needs to hold it until the
next statement finishes). if i'm wrong and you're right then the code that i
referenced that uses it is in trouble.

Comment 4

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 189947 [details] [diff] [review]
mark the value before it passing it to a function that can cause it to be gc'd

OK, sure.

Comment 5

[timeless]

Comment on attachment 189947 [details] [diff] [review]
mark the value before it passing it to a function that can cause it to be gc'd

we'd like to have this for our product which is probably going to be stuck with
this branch for a year.

Comment 6

[Brendan Eich [:brendan]]

Comment on attachment 189947 [details] [diff] [review]
mark the value before it passing it to a function that can cause it to be gc'd

How about a comment before that AUTO_MARK_JSVAL macro call, and a blank line
after?	r=me in lieu of dbradley, and approving.

/be

Comment 7

[timeless]

Comment on attachment 189947 [details] [diff] [review]
mark the value before it passing it to a function that can cause it to be gc'd

mozilla/js/src/xpconnect/src/xpccomponents.cpp	1.74

Comment 8

[timeless]

*** Bug 306579 has been marked as a duplicate of this bug. ***