341640 - nsJSContext::BindCompiledEventHandler doesn't root target

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Trunk Firefox doesn't start with WAY_TOO_MUCH_GC defined because nsJSContext::BindCompiledEventHandler doesn't root target.  So we allocate a GC thing here:

js_NewGCThing
js_NewObject
XPCWrappedNative::Init
XPCWrappedNative::GetNewOrUsed
XPCWrappedNative::GetNewOrUsed
XPCConvert::NativeInterface2JSObject
nsXPConnect::WrapNative
nsJSContext::JSObjectFromInterface
nsJSContext::BindCompiledEventHandler
nsXULElement::CompileEventHandler

and then free it here:

js_GC
js_NewGCThing
AllocSlots
js_NewObject
js_CloneFunctionObject
nsJSContext::BindCompiledEventHandler
nsXULElement::CompileEventHandler

and then crash here:
#0  DefineProperty (cx=0xa9dfb0, obj=0x1179bd0,
    name=0x2aaab43689b8 "oncommandupdate", value=18324368, getter=0, setter=0,
    attrs=5, flags=0, tinyid=0)
    at /home/dbaron/builds/trunk/mozilla/js/src/jsapi.c:2521
#1  0x00002aaaaae7af73 in JS_DefineProperty (cx=Variable "cx" is not available.
)
    at /home/dbaron/builds/trunk/mozilla/js/src/jsapi.c:2611
#2  0x00002aaab4165f6c in nsJSContext::BindCompiledEventHandler (
    this=0xa9df40, aTarget=Variable "aTarget" is not available.
)
    at /home/dbaron/builds/trunk/mozilla/dom/src/base/nsJSEnvironment.cpp:1656
#3  0x00002aaab41fd5cb in nsXULElement::CompileEventHandler (this=0xd09450,
    aContext=0xa9df40, aTarget=0xd09450, aName=0x546dc0,
    aBody=@0x7fffffb7d070,
    aURL=0xa7c1b8 "chrome://browser/content/browser.xul", aLineNo=1,
    aHandler=@0x7fffffb7d1b0)
    at /home/dbaron/builds/trunk/mozilla/content/xul/content/src/nsXULElement.cpp:701

Comment 1

[timeless]

*** Bug 341725 has been marked as a duplicate of this bug. ***

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: patch

Comment 3

[Johnny Stenback (:jst)]

Comment on attachment 225994 [details] [diff] [review]
patch

sr=jst

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Checked in to trunk.