337407 - On tight memory js_NewGCThing can fail to initialize GC thing flags.

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Igor Bukanov]

When js_NewGCThing allocations the GC thing from from the last arena tail and js_PushLocalRoot fails due to a tight memory condition, then the flag byte corresponding to the allocated thing would not be initialized. Since after the allocation the sings is within arenaList->lastLimit, GC during the finalization phase would read the uninitialized value.

Comment 1

[Igor Bukanov]

Attachment: Minimal fix

The fix should go to Firefox >= 1.5.* branches as well.

Comment 2

[Brendan Eich [:brendan]]

Comment on attachment 221566 [details] [diff] [review]
Minimal fix

Safe fix, should ride along.

/be

Comment 3

[Igor Bukanov]

I committed the fix to the trunk.

Comment 4

[Igor Bukanov]

I committed the fix to MOZILLA_1_8_BRANCH

Comment 5

[Igor Bukanov]

I committed the patch to MOZILLA_1_8_0_BRANCH

Comment 6

[Igor Bukanov]

(In reply to comment #5)
> I committed the patch to MOZILLA_1_8_0_BRANCH
> 

Sorry about the commit: I misread the aproval status. Should i take this back?

Comment 7

[Igor Bukanov]

I reverted the previous commit to MOZILLA_1_8_0_BRANCH to wait until approval resolution.

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 221566 [details] [diff] [review]
Minimal fix

approved for 1.8.0 branch, a=dveditz for drivers

Comment 9

[Igor Bukanov]

I committed the patch from comment 1 to MOZILLA_1_8_0_BRANCH.