1056899 - Don't free COW elements until the end of object finalization

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

Jon noticed this while working on compacting GC.  If an owner object with COW elements is finalized before other objects pointing to its elements are, then during finalization those other objects could use the now freed elements pointer.  The attached patch fixes this by not freeing COW elements until the FreeOp itself is destroyed, which will happen after all objects have been finalized.

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

Comment 3

[Jon Coppeard (:jonco)]

Comment on attachment 8476744 [details] [diff] [review]
patch

Review of attachment 8476744 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks for fixing.

It would be nice if we could get around the unhandleable OOM situation, but I can't see a straightforward way to do that.

Comment 4

[Brian Hackett [Laid off!]]

Unfortunately FreeOp can't be MOZ_STACK_CLASS because of runtime->defaultFreeOp().  The default free op isn't used for GC thing finalization though so I just added an assert in freeLater().

https://hg.mozilla.org/integration/mozilla-inbound/rev/2f5bca505197

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/2f5bca505197