1018638 - Zone groups can include zones that are not being collected

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

I was doing some testing of zone GCs today to try to track down the cause of the assertion failures in bug 1016738 and I found this problem. This means that, whenever we use GCZoneGroupIter or GCCompartmentGroupIter, we're potentially iterating over zones/compartments that aren't being collected. I'm not sure what the consequences of this are. We rarely do zone GCs, so it's not likely to happen too much. But zone GCs can be triggered by allocating a lot, so it's a potential security issue. Looks like a regression from bug 982561.

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: zone-fix

Comment 2

[Jon Coppeard (:jonco)]

Comment on attachment 8432156 [details] [diff] [review]
zone-fix

Review of attachment 8432156 [details] [diff] [review]:
-----------------------------------------------------------------

Ah yes, I missed that possibility.  Thanks for the fix.

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/cb3e958fc249

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/cb3e958fc249

Comment 6

[Matt Wobensmith [:mwobensmith][:matt:]]

Looks like we found this from an audit. If a test case or steps to reproduce surface, we'd be happy to verify the fix, but for now, marking qe-verify-. Thank you.