1598082 - ModuleObject::instantiateFunctionDeclarations should be clearer about ownership of |funDecls|

Status: RESOLVED FIXED

(Core :: JavaScript Engine, task, P3)

Description

[Jeff Walden [:Waldo]]

ModuleObject::instantiateFunctionDeclarations grabs an owning funDecls pointer, iterates through its contents filling in stuff in the actual module environment, then frees funDecls and returns. But that filling-in process can fail. (I don't remember module semantics enough to know if this is triggerable other than by OOM.) And if it does, funDecls will never be freed.

Comment 1

[Jon Coppeard (:jonco)]

(In reply to Jeff Walden [:Waldo] from comment #0)

But that filling-in process can fail.

In that case the pointer is freed by the module object's finalizer: https://searchfox.org/mozilla-central/source/js/src/builtin/ModuleObject.cpp#780-783

Comment 2

[Jeff Walden [:Waldo]]

Oh, bah -- that finalizer relationship is not horribly clear when you read this. Let's add some comments.

Comment 3

[Jeff Walden [:Waldo]]

Attachment: Bug 1598082 - Add comments to |ModuleObject::instantiateFunctionDeclarations| clarifying ownership of |funDecls|. r=jonco

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/73eab6e12fdb
Add comments to |ModuleObject::instantiateFunctionDeclarations| clarifying ownership of |funDecls|.  r=jonco

Comment 5

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/mozilla-central/rev/73eab6e12fdb