600082 - AT may crash when it frees memory allocated for header cell array by server

Status: RESOLVED FIXED

(Core :: Disability Access APIs, defect)

Description

[alexander :surkov (:asurkov)]

Attachment: patch

I think the problem we allocate memory by nsMemory::Allocate which is not thread safe. It's reasonable to use CoTaskMemAlloc here (AT use CoTaskMemFree to free  memory allocated by Firefox).

It was tested as a part of try-server build, it must be safe to land it for Firefox 3.6 as well.

Comment 1

[Marco Zehe (:MarcoZ)]

This would be a speedy landing/review, since code freeze for 3.6.11 is tonight, September 28, 2010 11:50 PDT IIRC. I agree this is needed to prevent crashes with assistive technologies properly wanting to support the new table interfaces. Requesting blocking 1.9.2.

Comment 2

[alexander :surkov (:asurkov)]

Comment on attachment 478921 [details] [diff] [review]
patch

let's speed up review process :)

all we need is to get blocking status for 2.0 and 1.9.2. 

This is really urgent to land on 1.9.2 because AT developer is going to disable new table interface usage on their side while this bug is not fixed. That would be a big step back.

Comment 3

[Marco Zehe (:MarcoZ)]

Comment on attachment 478921 [details] [diff] [review]
patch

Yep, this is correct. I remember having seen this kind of problem earlier in my C++ life. :) R=me.

Do we have other places in the msaa codebase where this could bite us?

Comment 4

[alexander :surkov (:asurkov)]

Yes, but I didn't check it.

Comment 5

[David Bolter [:davidb] (NeedInfo me for attention)]

Approving blocking b7, there is urgency for this.

Comment 6

[Marco Zehe (:MarcoZ)]

Landed on Alexander's behalf on 2.0: http://hg.mozilla.org/mozilla-central/rev/530a551da062

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 478921 [details] [diff] [review]
patch

a=beltzner

Comment 8

[Marco Zehe (:MarcoZ)]

Landed on 1.9.2 on Alexander's behalf: http://hg.mozilla.org/releases/mozilla-1.9.2/rev/7cd8c155da8d

Comment 9

[alexander :surkov (:asurkov)]

Thanks, Marco!