521608 - nsCanvasRenderingContext2D::GetPresShell may crash or leak

Status: RESOLVED FIXED

(Core :: Graphics: Canvas2D, defect, P2)

Description

[Olli Pettay [:smaug][[e-mail]]]

See https://bugzilla.mozilla.org/show_bug.cgi?id=502715#c15

Comment 1

[Rob Arnold [:robarnold]]

I was told by jst that GetOwnerDoc doesn't return null (at least not in any circumstances that JS code can trigger).

The memory leak does appear to be valid. What's the damage done by leaking?

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

GetOwnerDoc may return null.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

(In reply to comment #1)
> What's the damage done by leaking?
Are you really asking this question? ;)

Leaking a presshell may leak a document, cssframeconstructor,
styleset, etc.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Attachment: patch

Rob, could you test this on windows 7.

Comment 5

[Rob Arnold [:robarnold]]

Comment on attachment 405758 [details] [diff] [review]
patch

I'm not the right person to review this. Vlad and/or jst should look at this. Also, a crash test would be nice (or at least an explanation of why it can return NULL).

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

Well,  could you at least test this on Win7?

Bug 335998 is about element not having strong ref to owner document.

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/mozilla-central/rev/1f0ca450bcb0

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/0387ecf0a6c7