Closed Bug 518675 Opened 15 years ago Closed 15 years ago

JSAutoTempValueRooter(...) is bad mojo

Categories

(Core :: JavaScript Engine, defect, P1)

Product:
Core
Component:
JavaScript Engine
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
status1.9.2 --- beta1-fixed
blocking1.9.1 --- .4+
status1.9.1 --- .4-fixed

People

(Reporter: Waldo, Assigned: Waldo)

Details

(Keywords: verified1.9.1, Whiteboard: [sg:critical?] (possible gc race condition?) fixed-in-tracemonkey)

Attachments

(1 file)

Patch
2.11 KB, patch
dvander
: review+
dveditz
: approval1.9.1.4+
Details | Diff | Splinter Review 
Creates a root, immediately unroots, value expected to be protected, isn't.  Yikes.
Attached patch Patch — — Splinter Review 

        Attachment #402673 -
        Flags: review?(dvander)

        Attachment #402673 -
        Flags: review?(dvander) → review+

    
    

    
  
http://hg.mozilla.org/tracemonkey/rev/33825a77eba8
Whiteboard: fixed-in-tracemonkey

    
  

        Attachment #402673 -
        Flags: approval1.9.1.5?

        Attachment #402673 -
        Flags: approval1.9.1.4?

    
    

    
  
Comment on attachment 402673 [details] [diff] [review]
Patch

This is minimal enough that it could easily be added to 1.9.1.4, if sufficient time remains, without any meaningful worries.  I leave it up to approvers to consider whether it's worthwhile -- it'd be hard to get the failure precisely so for it to matter, but I think it is worthwhile to do it now rather than give people extra time to play with this.

Since this is a C++-only failure 1.9.0 is not affected; I presume a 1.9.2 merge by sayrer will pick this up in due course.

    
  
Flags: blocking1.9.2?

    
    

    
  
Could use a merge to m-c, leaving to the traditional merger so as not to cross the streams...

    
    

    
  
If this is a potential security problem we should hide the bug. We've treated this kind of problem as potentially [sg:critical?] in the past so we should hide the bug until it's fixed.
Group: core-security
blocking1.9.1: --- → ?

          status1.9.1:
          --- → wanted
Flags: wanted1.9.0.x-
Whiteboard: fixed-in-tracemonkey → [sg:critical?] (possible gc race condition?) fixed-in-tracemonkey

    
    

    
  
Comment on attachment 402673 [details] [diff] [review]
Patch

Approved for 1.9.1.4, a=dveditz for release-drivers

trivial fix, better safe than sorry.

        Attachment #402673 -
        Flags: approval1.9.1.5?

        Attachment #402673 -
        Flags: approval1.9.1.4?

        Attachment #402673 -
        Flags: approval1.9.1.4+

    
    

    
  
Verified for 1.9.1 in source.
Keywords: verified1.9.1
blocking1.9.1: ? → .4+

    
  
Flags: blocking1.9.2? → blocking1.9.2+

    
  
Priority: -- → P1

    
    

    
  
http://hg.mozilla.org/mozilla-central/rev/33825a77eba8
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
Group: core-security

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: