Zone groups can include zones that are not being collected

RESOLVED DUPLICATE of bug 1018638

Status

()

Core
JavaScript: GC
RESOLVED DUPLICATE of bug 1018638
3 years ago
a year ago

People

(Reporter: billm, Assigned: billm)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 obsolete attachment)

(Assignee)

Description

3 years ago
I was doing some testing of zone GCs today to try to track down the cause of the assertion failures in bug 1016738 and I found this problem. This means that, whenever we use GCZoneGroupIter or GCCompartmentGroupIter, we're potentially iterating over zones/compartments that aren't being collected. I'm not sure what the consequences of this are. We rarely do zone GCs, so it's not likely to happen too much. But zone GCs can be triggered by allocating a lot, so it's a potential security issue. Looks like a regression from bug 982561.
(Assignee)

Comment 1

3 years ago
Somehow I ended up filing two bugs for this?
Status: NEW → RESOLVED
Last Resolved: 3 years ago
Resolution: --- → INVALID
Resolution: INVALID → DUPLICATE
Duplicate of bug: 1018638
Attachment #8432153 - Attachment is obsolete: true
Attachment #8432153 - Flags: review?

Updated

2 years ago
Group: core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.