Closed
Bug 501701
Opened 16 years ago
Closed 16 years ago
Sampler doesn't nuke pointers of some deleted AS3 objects and crashes
Categories
(Tamarin Graveyard :: Garbage Collection (mmGC), defect)
Tracking
(Not tracked)
VERIFIED
FIXED
People
(Reporter: achicu, Unassigned)
Details
Attachments
(1 file)
|
989 bytes,
patch
|
treilly
:
review+
edwsmith
:
superreview+
|
Details | Diff | Splinter Review |
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5
Build Identifier:
In GC::Free the "bail:" label doesn't send the FinalizeHook event for some AS3 objects. The sampler will never now the object was destroyed and it will crash later when SamplerScript.cpp:makeSample will try to create an AS3 NewObjectSample object.
Here is the "bail:" label:
http://hg.mozilla.org/tamarin-redux/file/6b3f137551ef/MMgc/GC.cpp#l1391
Reproducible: Sometimes
Actual Results:
The application crashes.
|
Reporter | |
Comment 1•16 years ago
|
||
I've added a comment in the patch.
Attachment #393182 -
Flags: superreview?(edwsmith)
Attachment #393182 -
Flags: review?(treilly)
|
||
Updated•16 years ago
|
Attachment #393182 -
Flags: review?(treilly) → review+
|
||
Updated•16 years ago
|
Attachment #393182 -
Flags: superreview?(edwsmith) → superreview+
|
||
Comment 2•16 years ago
|
||
Pushed on Aug 12 by treilly.
Status: UNCONFIRMED → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
|
||
Comment 3•16 years ago
|
||
Resolved fixed engineering / work item that has been pushed. Setting status to verified.
Status: RESOLVED → VERIFIED
You need to log in
before you can comment on or make changes to this bug.
Description
•