Last Comment Bug 337407 - On tight memory js_NewGCThing can fail to initialize GC thing flags.
: On tight memory js_NewGCThing can fail to initialize GC thing flags.
Status: RESOLVED FIXED
: fixed1.8.0.5, fixed1.8.1
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Linux
: -- normal (vote)
: ---
Assigned To: Igor Bukanov
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2006-05-10 02:19 PDT by Igor Bukanov
Modified: 2006-07-19 15:33 PDT (History)
2 users (show)
bob: in‑testsuite-
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Minimal fix (1005 bytes, patch)
2006-05-10 02:33 PDT, Igor Bukanov
brendan: review+
brendan: approval‑branch‑1.8.1+
dveditz: approval1.8.0.5+
Details | Diff | Review

Description Igor Bukanov 2006-05-10 02:19:07 PDT
When js_NewGCThing allocations the GC thing from from the last arena tail and js_PushLocalRoot fails due to a tight memory condition, then the flag byte corresponding to the allocated thing would not be initialized. Since after the allocation the sings is within arenaList->lastLimit, GC during the finalization phase would read the uninitialized value.
Comment 1 Igor Bukanov 2006-05-10 02:33:13 PDT
Created attachment 221566 [details] [diff] [review]
Minimal fix

The fix should go to Firefox >= 1.5.* branches as well.
Comment 2 Brendan Eich [:brendan] 2006-05-10 09:32:07 PDT
Comment on attachment 221566 [details] [diff] [review]
Minimal fix

Safe fix, should ride along.

/be
Comment 3 Igor Bukanov 2006-05-11 15:54:00 PDT
I committed the fix to the trunk.
Comment 4 Igor Bukanov 2006-05-17 09:26:29 PDT
I committed the fix to MOZILLA_1_8_BRANCH
Comment 5 Igor Bukanov 2006-06-06 04:53:30 PDT
I committed the patch to MOZILLA_1_8_0_BRANCH
Comment 6 Igor Bukanov 2006-06-06 04:55:40 PDT
(In reply to comment #5)
> I committed the patch to MOZILLA_1_8_0_BRANCH
> 

Sorry about the commit: I misread the aproval status. Should i take this back?
Comment 7 Igor Bukanov 2006-06-06 05:11:27 PDT
I reverted the previous commit to MOZILLA_1_8_0_BRANCH to wait until approval resolution.
Comment 8 Daniel Veditz [:dveditz] 2006-06-14 14:55:39 PDT
Comment on attachment 221566 [details] [diff] [review]
Minimal fix

approved for 1.8.0 branch, a=dveditz for drivers
Comment 9 Igor Bukanov 2006-06-14 15:40:17 PDT
I committed the patch from comment 1 to MOZILLA_1_8_0_BRANCH.

Note You need to log in before you can comment on or make changes to this bug.