518675 - JSAutoTempValueRooter(...) is bad mojo

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jeff Walden [:Waldo]]

Creates a root, immediately unroots, value expected to be protected, isn't.  Yikes.

Comment 1

[Jeff Walden [:Waldo]]

Attachment: Patch

Comment 2

[Jeff Walden [:Waldo]]

http://hg.mozilla.org/tracemonkey/rev/33825a77eba8

Comment 3

[Jeff Walden [:Waldo]]

Comment on attachment 402673 [details] [diff] [review]
Patch

This is minimal enough that it could easily be added to 1.9.1.4, if sufficient time remains, without any meaningful worries.  I leave it up to approvers to consider whether it's worthwhile -- it'd be hard to get the failure precisely so for it to matter, but I think it is worthwhile to do it now rather than give people extra time to play with this.

Since this is a C++-only failure 1.9.0 is not affected; I presume a 1.9.2 merge by sayrer will pick this up in due course.

Comment 4

[Jeff Walden [:Waldo]]

Could use a merge to m-c, leaving to the traditional merger so as not to cross the streams...

Comment 5

[Daniel Veditz [:dveditz]]

If this is a potential security problem we should hide the bug. We've treated this kind of problem as potentially [sg:critical?] in the past so we should hide the bug until it's fixed.

Comment 6

[Daniel Veditz [:dveditz]]

Comment on attachment 402673 [details] [diff] [review]
Patch

Approved for 1.9.1.4, a=dveditz for release-drivers

trivial fix, better safe than sorry.

Comment 7

[Jeff Walden [:Waldo]]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/eedb768cfbb8

Comment 8

[Robert Sayre]

looks like at least one person has hit this:

http://crash-stats.mozilla.com/report/index/a7412eac-60f6-4c0f-8706-ec6282090922

Comment 9

[Al Billings [:abillings - ex-MoCo]]

Verified for 1.9.1 in source.

Comment 10

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/33825a77eba8

Comment 11

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/dc75d52e2357