362180 - Still missing root in JS_NewPropertyIterator

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Igor Bukanov]

The patch for bug 343290 did not root iterobj. As such if non-native would ever allocate a new object, the GC hazard still presents.

Comment 1

[Igor Bukanov]

Attachment: Fix

The patch roots iterobj, not obj. 

In addition the patch replaces set_slot calls by the explicit slot access. The current code that calls JS_SetPrivate and jumps to "bad" is incorrect as it does not destroys ida array. This is not a memory leak since JS_SetPrivate always returns true, but it does require spending time to figure out what is going on. So to avoid reasoning in future I made this change.

Comment 2

[Igor Bukanov]

I committed the patch from comment 1 to the trunk:

Checking in jsapi.c;
/cvsroot/mozilla/js/src/jsapi.c,v  <--  jsapi.c
new revision: 3.291; previous revision: 3.290
done

Comment 3

[Igor Bukanov]

Comment on attachment 246883 [details] [diff] [review]
Fix

The patch applies to 1.8.* as is.

Comment 4

[Daniel Veditz [:dveditz]]

Comment on attachment 246883 [details] [diff] [review]
Fix

approved for 1.8/1.8.0 branches, a=dveditz for drivers

Comment 5

[Igor Bukanov]

I committed the patch from comment 1 to MOZILLA_1_8_BRANCH:

Checking in jsapi.c;
/cvsroot/mozilla/js/src/jsapi.c,v  <--  jsapi.c
new revision: 3.214.2.32; previous revision: 3.214.2.31
done

Comment 6

[Igor Bukanov]

I committed the patch from comment 1 to MOZILLA_1_8_0_BRANCH:

Checking in jsapi.c;
/cvsroot/mozilla/js/src/jsapi.c,v  <--  jsapi.c
new revision: 3.214.2.11.2.9; previous revision: 3.214.2.11.2.8
done

Comment 7

[Martijn Wargers (dead)]

Verified fixed on branches by looking at the bonsai logs of the MOZILLA_1_8_0_BRANCH tree and the MOZILLA_1_8_BRANCH tree.