1800050 - malloc vs operator delete [] mismatch in WriteCachedStencil

Status: RESOLVED FIXED

(Core :: JavaScript Engine, task, P1)

Description

[Tooru Fujisawa [:arai]]

https://bugzilla.mozilla.org/show_bug.cgi?id=1799250#c4

JS::TranscodeBuffer::extractOrCopyRawBuffer returns a buffer allocated with malloc, and it needs free.
WriteCachedStencil receives the buffer into UniquePtr<char[]>, which uses delete[].

(as pointed out in https://bugzilla.mozilla.org/show_bug.cgi?id=1799250#c7 , this doesn't need immediate fix)

Possible solutions are:

1. always copy the JS::TranscodeBuffer content into a new buffer allocated with new[]
2. modify the JS::TranscodeBuffer to use new[]
3. support free in StartupCache

1 is the simplest, but it needs extra copy.

Comment 1

[Tooru Fujisawa [:arai]]

FontNameCache::WriteCache also passes malloc-ed buffer to StartupCache::PutBuffer

https://searchfox.org/mozilla-central/rev/6f77213807eb5359c8afe458ac5628f973e92a25/gfx/thebes/gfxFT2FontList.cpp#725,747

void WriteCache() {
...
  mCache->PutBuffer(CACHE_KEY, UniquePtr<char[]>(ToNewCString(buf)),

Other places uses MakeUnique<char[]>.

Comment 2

[Tooru Fujisawa [:arai]]

I'll look into switching all consumers to use malloc/free.

Comment 3

[Tooru Fujisawa [:arai]]

Attachment: Bug 1800050 - Use UniqueFreePtr in StartupCache::PutBuffer. r?nbp!

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/02350fa31397
Use UniqueFreePtr in StartupCache::PutBuffer. r=nbp

Comment 5

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/02350fa31397