1803682 - If CreateInterfaceObjects fails, call right below might try to reenter, causing stack exhaustion

Status: RESOLVED DUPLICATE of bug 1746997

(Core :: DOM: Bindings (WebIDL), defect)

Description

[Emilio Cobos Álvarez (:emilio)]

See bp-91379609-0ad0-4b54-8f05-97c590221130 for an example.

Comment 1

[Andrew McCreight [:mccr8]]

Here is a search for crashes that might be this issue. Basically, where the signature contains stackoverflow and the proto signature contains CreateInterfaceObjects. (The date is in there so if you do this much later it might not work.)

Comment 2

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1803682 - Deal with dom::CreateInterfaceObjects() failing gracefully. r=peterv

The code before this patch could end up looking like this:

JS::Heap<JSObject*>* protoCache = &aProtoAndIfaceCache.EntrySlotOrCreate(prototypes::id::FontFaceSet);
JS::Heap<JSObject*>* interfaceCache = &aProtoAndIfaceCache.EntrySlotOrCreate(constructors::id::FontFaceSet);
dom::CreateInterfaceObjects(aCx, aGlobal, parentProto,
                            &sPrototypeClass.mBase, protoCache,
                            constructorProto, &sInterfaceObjectClass.mBase, 0, false, nullptr,
                            interfaceCache,
                            sNativeProperties.Upcast(),
                            nullptr,
                            "FontFaceSet", aDefineOnGlobal,
                            nullptr,
                            false,
                            nullptr,
                            false);

// Set up aliases on the interface prototype object we just created.
JS::Handle<JSObject*> proto = GetProtoObjectHandle(aCx);

If CreateInterfaceObjects() fails (leaving protoCache null),
GetProtoObjectHandle() would reenter CreateInterfaceObjects(), causing
stack exhaustion.

After this patch the code looks like:

JS::Heap<JSObject*>* protoCache = &aProtoAndIfaceCache.EntrySlotOrCreate(prototypes::id::FontFaceSet);
JS::Heap<JSObject*>* interfaceCache = &aProtoAndIfaceCache.EntrySlotOrCreate(constructors::id::FontFaceSet);
dom::CreateInterfaceObjects(aCx, aGlobal, parentProto,
                            &sPrototypeClass.mBase, protoCache,
                            constructorProto, &sInterfaceObjectClass.mBase, 0, false, nullptr,
                            interfaceCache,
                            sNativeProperties.Upcast(),
                            nullptr,
                            "FontFaceSet", aDefineOnGlobal,
                            nullptr,
                            false,
                            nullptr,
                            false);
if (!*protoCache) {
  MOZ_ASSERT_IF(interfaceCache, !*interfaceCache);
  return;
}

// Set up aliases on the interface prototype object we just created.
JS::AssertObjectIsNotGray(*protoCache);
auto proto = JS::Handle<JSObject*>::fromMarkedLocation(protoCache->address());
MOZ_ASSERT(proto);

Which should handle failure properly.