1031920 - If JS_NewArrayBufferWithContents fails, ArrayBufferBuilder::getArrayBuffer calls js_free(nullptr)

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/mozilla-central/rev/ebdd57580809 looks odd.
    1.11    JSObject* obj = JS_NewArrayBufferWithContents(aCx, mLength, mDataPtr);
    1.12 +  mDataPtr = nullptr;
    1.13 +  mLength = mCapacity = 0;
    1.14    if (!obj) {
    1.15 +    js_free(mDataPtr);
    1.16      return nullptr;
    1.17    }

We set mDataPtr to null and then if obj is null, try to free mDataPtr.

Comment 1

[Andrew McCreight (out of office until 8/21) [:mccr8]]

Yeah, it looks like this will leak whatever was in mDataPtr on failure.

Comment 2

[Michael]

Attachment: xhr-leak.patch

Comment 3

[Michael]

Attachment: Patch for checkin, r=smaug

Comment 4

[Carsten Book [:Tomcat]]

Hi Michael, 

could you provide a try run for this checkin? Thanks!

Comment 5

[Michael]

Unfortunately no, don't have commit access.

Comment 6

[Andrew McCreight (out of office until 8/21) [:mccr8]]

I'll do a try run today and set checkin needed when it is done.

Comment 7

[Andrew McCreight (out of office until 8/21) [:mccr8]]

https://tbpl.mozilla.org/?tree=Try&rev=ccc5d73f13ec

Comment 8

[Andrew McCreight (out of office until 8/21) [:mccr8]]

Sorry this took so long, our test infrastructure was really backed up for some reason.  Try run is green.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/650af90512e2

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/650af90512e2