114356 - FMM: freeing mismatched mem in nsFormSubmitter::URLEncode

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[John Morrison]

I'll attach the Purify details in a moment. Calling delete on a string that 
was malloc'd. Looks also like there is a second case in the same routine
that should be free'ing, although I didn't hit that code path with pruify.

I get the FMM just from submitting the form on 
http://cowtools/page-loader/loader.pl, but that is a very vanilla form, 
so I assume any form would do for testing.

Comment 1

[John Morrison]

Attachment: purify output of FMM location

Comment 2

[Boris Zbarsky [:bzbarsky]]

The comment before the allocation point says:

 // XXX This is inefficient.  When nsAString gets a get() equivalent,

This code should likely be rewritten using nsPromiseFlatString, which does its
own memory management.... the problem will die a natural and easy death then.

Comment 3

[kill this account]

*** Bug 115386 has been marked as a duplicate of this bug. ***

Comment 4

[John Keiser (jkeiser)]

I do believe this is fixed with bug 120682.

Comment 5

[Kevin McCluskey (gone)]

Marking nsbeta1+

Comment 6

[John Keiser (jkeiser)]

This should be fixed now.  A problem where we did new and ::Free in this
function was found and fixed.

Comment 7

[Vladimir Ermakov]

verifying per developer's coments

Comment 8

[John Morrison]

So, these FMM's are gone, but there are new mismatches in the new code. 
See 'Part deux', bug 127806.