551507 - Bad auto root usage in jstypedarray.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Igor Bukanov]

js_CreateTypedArray from jstypedarray.cpp contains:

...
    jsval vals[2];
    AutoArrayRooter tvr(cx, JS_ARRAY_LENGTH(vals), vals);

    if (!js_NewNumberInRootedValue(cx, jsdouble(nelements), &vals[0]))
        return NULL;

This does not null the vals array before rooting it with tvr. If js_NewNumberInRootedValue triggers the GC, than that GC will try to mark unitialized value.

Comment 1

[Andreas Gal :gal]

Attachment: patch

My bad. I reviewed it.

Comment 2

[Andreas Gal :gal]

This is only in trunk and not in any of our products.

Comment 3

[Jeff Walden [:Waldo]]

Comment on attachment 431666 [details] [diff] [review]
patch

Stealing...

I suggest JSVAL_NULL simply because that's 0 and might conceivably initialize faster, with no semantic difference -- or it might just be talismanic.

Comment 4

[Andreas Gal :gal]

All yours waldo :)

Comment 5

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Changed to NULL and pushed to tm, at brendan's request:

http://hg.mozilla.org/tracemonkey/rev/80fc5dcabaf9

Some stack helpers for this might be nice.. e.g. RootedJSValArray vals(4); or something.

Comment 6

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Sayrer, can we get this merged pretty soon?

Comment 7

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/80fc5dcabaf9