414764 - CToken freed too many times with <table>m</p>

Status: RESOLVED FIXED

(Core :: DOM: HTML Parser, defect, P2)

Description

[Martijn Wargers (dead)]

I get this output with current debug trunk build and trace-malloc enabled:
== BloatView: ALL (cumulative) LEAK STATISTICS

     |<----------------Class--------------->|<-----Bytes------>|<----------------Objects---------------->|<--------------References-------------->|
                                              Per-Inst   Leaked    Total      Rem      Mean       StdDev     Total      Rem      Mean       StdDev
   0 TOTAL                                          23        0   503690        0 ( 1065.91 +/-  1396.41)  1065960       -1 ( 1365.49 +/-  2149.51)
  15 CToken                                         24        0      770        0 (  150.72 +/-   110.86)     1247       -1 (  148.69 +/-   108.09)


I'm a bit confused by this. CToken is mentioned, but it doesn't seem to have been leaking, but why is it then shown? Or is this still a memory leak?

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Oops, this is a bug caused by the fix for bug 142965. It's the opposite of a leak, we're freeing a token one too many times.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

I can't get enough context in the diff (even with -U8) but if you look at the file, you'll see a corresponding IF_HOLD in the other case.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

I doubt this is exploitable, but we should probably fix it.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 300280 [details] [diff] [review]
Fix

This doesn't need to go in for b3, but it's a pretty safe code correctness fix.

Comment 5

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Sounds scary as these thing generally are exploitable. So unless we're 100% sure this one is not we should really fix it.

Comment 6

[Mike Schroepfer]

Comment on attachment 300280 [details] [diff] [review]
Fix

When in doubt with mem - fix it

Comment 7

[Johnny Stenback (:jst)]

Fix checked in.