Closed Bug 337407 Opened 15 years ago Closed 15 years ago
On tight memory js
_New GCThing can fail to initialize GC thing flags .
When js_NewGCThing allocations the GC thing from from the last arena tail and js_PushLocalRoot fails due to a tight memory condition, then the flag byte corresponding to the allocated thing would not be initialized. Since after the allocation the sings is within arenaList->lastLimit, GC during the finalization phase would read the uninitialized value.
The fix should go to Firefox >= 1.5.* branches as well.
Assignee: general → igor.bukanov
Status: NEW → ASSIGNED
Attachment #221566 - Flags: review?(brendan)
Comment on attachment 221566 [details] [diff] [review] Minimal fix Safe fix, should ride along. /be
I committed the fix to the trunk.
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
I committed the fix to MOZILLA_1_8_BRANCH
I committed the patch to MOZILLA_1_8_0_BRANCH
(In reply to comment #5) > I committed the patch to MOZILLA_1_8_0_BRANCH > Sorry about the commit: I misread the aproval status. Should i take this back?
I reverted the previous commit to MOZILLA_1_8_0_BRANCH to wait until approval resolution.
Comment on attachment 221566 [details] [diff] [review] Minimal fix approved for 1.8.0 branch, a=dveditz for drivers
Attachment #221566 - Flags: approval184.108.40.206? → approval220.127.116.11+
You need to log in before you can comment on or make changes to this bug.