1372643 - ScriptLoader::EncodeBytecode might be called after dropping the document reference.

Status: RESOLVED FIXED

(Core :: JavaScript Engine, enhancement)

Description

[Nicolas B. Pierron [:nbp]]

ScriptLoader::EncodeBytecode currently use get the script global out of the mDocument field.  We should check that mDocument is not null before calling GetScriptGlobalObject.

Comment 1

[Nicolas B. Pierron [:nbp]]

Attachment: Guard ScriptLoader::GetScriptGlobalObject with mDocument weak-ptr check.

This function is used in various places where it might not be obvious that
mDocument is not null, and in EncodeBytecode and GiveUpBytecodeEncoding
where it might potentially be nullified on the mDocument destruction, while
the ScriptLoader is kept alive by the NewRunnableMethod from MaybeTriggerBytecodeEncoding.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1ea55f730fc0
Guard ScriptLoader::GetScriptGlobalObject with mDocument weak-ptr check. r=mrbkap

Comment 3

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/1ea55f730fc0