327716 - XPC_NW_NewResolve should root its cloned function object

Status: RESOLVED FIXED

(Core :: XPConnect, defect, P1)

Description

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

XPC_NW_NewResolve clones a function object and passes it to WrapFunction, which creates another function, which means the first one can be destroyed:

js_GC (/builds/trunk/mozilla/js/src/jsgc.c:1947)
js_NewGCThing (/builds/trunk/mozilla/js/src/jsgc.c:635)
js_NewObject (/builds/trunk/mozilla/js/src/jsobj.c:2008)
js_NewFunction (/builds/trunk/mozilla/js/src/jsfun.c:2030)
JS_NewFunction (/builds/trunk/mozilla/js/src/jsapi.c:3403)
WrapFunction (/builds/trunk/mozilla/js/src/xpconnect/src/XPCNativeWrapper.cpp:236)
XPC_NW_NewResolve (/builds/trunk/mozilla/js/src/xpconnect/src/XPCNativeWrapper.cpp:860)

Comment 1

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Attachment: possible patch

Not sure whether this is the best approach, but it works.

Comment 2

[Brendan Eich [:brendan]]

Comment on attachment 212311 [details] [diff] [review]
possible patch

Sure, that will work and seems necessary in general (alas).

Again it might be better to root as soon as possible, so even before the DEBUG_XPCNativeWrapper paragraph.

/be

Comment 3

[Johnny Stenback (:jst)]

Comment on attachment 212311 [details] [diff] [review]
possible patch

r=jst

Comment 4

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Checked in to trunk.

Comment 5

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Checked in to MOZILLA_1_8_BRANCH.

Comment 6

[Jay Patel [:jay]]

Comment on attachment 212311 [details] [diff] [review]
possible patch

Please check in promptly on the 1.8.0 branch.  Thanks!

Comment 7

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Fix checked in to MOZILLA_1_8_0_BRANCH.