880392 - GC: fix exact rooting in XPCShell

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Terrence Cole [:terrence]]

XPCShell's main function has code like:

{
  Rooted<> envobj(cx, ...);
  ...
  JS_DestroyContext(cx);
}

Naturally, when ~envobj fires, |stack| is dead because the cx has been destroyed. 

This is currently preventing debug builds on tbpl from completing because this crashes when generating the stage packages. Opt builds appear to "work" because we don't poison on free() -- it's just a use-after-free.

Comment 1

[Terrence Cole [:terrence]]

Attachment: v0: tested and verified working

Comment 2

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/29363d0fd7ff

Comment 3

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/29363d0fd7ff