1117851 - nsJSUtils::GetCallingLocation is a memory hazard footgun

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Bobby Holley (:bholley)]

I noticed this while reviewing bug 1097998. The API returns an unowned char*, which is effectively valid until the next GC, because the guard object goes out of scope when nsJSUtils::GetCallingLocation returns.

I just audited all the callers, and it looks like we're safe for now. But we should fix this before someone screws it up. I'll attach a patch.

Comment 1

[Bobby Holley (:bholley)]

Attachment: Make GetCallingLocation take an nsA{,C}String. v1

Comment 2

[Bobby Holley (:bholley)]

https://treeherder.mozilla.org/ui/#/jobs?repo=try&revision=f108af2f7e84

Comment 3

[Bobby Holley (:bholley)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9035e4de3c03

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/9035e4de3c03

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Backed out at smaug's request due to bug 1118257.
https://hg.mozilla.org/integration/mozilla-inbound/rev/a3a485cf8fda

Comment 6

[Ryan VanderMeulen [:RyanVM]]

....which caused other bustage. Re-landed.
https://hg.mozilla.org/integration/mozilla-inbound/rev/d8541085a5d5

Smaug says he'll prepare a backout patch. Leaving the bug open since that's where it's still going.

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

Attachment: backout patch

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/d8541085a5d5