Note: There are a few cases of duplicates in user autocompletion which are being worked on.

On tight memory js_NewGCThing can fail to initialize GC thing flags.

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
11 years ago
11 years ago

People

(Reporter: Igor Bukanov, Assigned: Igor Bukanov)

Tracking

({fixed1.8.0.5, fixed1.8.1})

Trunk
x86
Linux
fixed1.8.0.5, fixed1.8.1
Points:
---
Bug Flags:
in-testsuite -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

11 years ago
When js_NewGCThing allocations the GC thing from from the last arena tail and js_PushLocalRoot fails due to a tight memory condition, then the flag byte corresponding to the allocated thing would not be initialized. Since after the allocation the sings is within arenaList->lastLimit, GC during the finalization phase would read the uninitialized value.
(Assignee)

Comment 1

11 years ago
Created attachment 221566 [details] [diff] [review]
Minimal fix

The fix should go to Firefox >= 1.5.* branches as well.
Assignee: general → igor.bukanov
Status: NEW → ASSIGNED
Attachment #221566 - Flags: review?(brendan)
Comment on attachment 221566 [details] [diff] [review]
Minimal fix

Safe fix, should ride along.

/be
Attachment #221566 - Flags: review?(brendan)
Attachment #221566 - Flags: review+
Attachment #221566 - Flags: approval1.8.0.5?
Attachment #221566 - Flags: approval-branch-1.8.1+
(Assignee)

Comment 3

11 years ago
I committed the fix to the trunk.
Status: ASSIGNED → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
(Assignee)

Comment 4

11 years ago
I committed the fix to MOZILLA_1_8_BRANCH
Keywords: fixed1.8.1
(Assignee)

Comment 5

11 years ago
I committed the patch to MOZILLA_1_8_0_BRANCH
Keywords: fixed1.8.0.5
(Assignee)

Comment 6

11 years ago
(In reply to comment #5)
> I committed the patch to MOZILLA_1_8_0_BRANCH
> 

Sorry about the commit: I misread the aproval status. Should i take this back?
(Assignee)

Comment 7

11 years ago
I reverted the previous commit to MOZILLA_1_8_0_BRANCH to wait until approval resolution.
Keywords: fixed1.8.0.5
Comment on attachment 221566 [details] [diff] [review]
Minimal fix

approved for 1.8.0 branch, a=dveditz for drivers
Attachment #221566 - Flags: approval1.8.0.5? → approval1.8.0.5+
(Assignee)

Comment 9

11 years ago
I committed the patch from comment 1 to MOZILLA_1_8_0_BRANCH.
Keywords: fixed1.8.0.5

Updated

11 years ago
Flags: in-testsuite-
You need to log in before you can comment on or make changes to this bug.