When printing http://www.mozilla.com/firefox/all on a trunk build with cairo disabled I get a valgrind warning about reading freed memory (attached). The attached patch fixes the warning. I haven't bothered to figure out the ownership model here -- but it seems to be working well enough except for this issue -- although I suppose I haven't checked for leaks. Then again, this code should be going away for 1.9.
Created attachment 240846 [details] [diff] [review] patch This fixes the warning. I'm not sure who owns the entry object, but this seems like the simplest patch to prevent the object from being accessed after being freed.
Checked in to trunk, although the code isn't used there.
Comment on attachment 240846 [details] [diff] [review] patch approved for 1.8 branch, a=dveditz for drivers
I believe the bugs addressed here are responsible for the problems described in bug 336435 (Firefox hangs following printing on Linux). I debugged this a couple of months ago, and attached a patch which fixed several double-free bugs, including the bugs fixed here. However, I also found an additional bug (a failure to increment the reference count on a CharSet following a look-up in fontconfig), which is fixed in the first part of my patch. See: https://bugzilla.mozilla.org/attachment.cgi?id=237126&action=view Can that part of the patch be reviewed and committed soon? (Please let me know if you want me to provide an updated patch). It would be nice to get all of these fixes into the next 1.5.0.x release, as these bugs are having a major impact on our users.
Ah, I now see that the additional bug I referred to was addressed in bug 294879, and a fix has already been checked in, and included in 126.96.36.199. So never mind about reviewing that part of my patch.
Checked in to MOZILLA_1_8_BRANCH.
Comment on attachment 240846 [details] [diff] [review] patch Approved for 1.8.0 branch, a=jay for drivers.
Checked in to MOZILLA_1_8_0_BRANCH.
hi david, can you provide steps on how QA can verify this fix on the 1.8 and 1.8.0 branch? thanks.