6045 - Incomplete cleanup in failure case in IL_GetImage

Status: VERIFIED FIXED

(Core :: Graphics: ImageLib, defect, P3)

Description

[vidur (gone)]

While fixing a bug of my own, I ran into the failure case shown below. This was
probably never hit in 4.x except in a low memory situation, when we probably
didn't survive in any case. It is hit in the current codebase, since the URL
returned could be null if it is malformed. When we go into the failture code,
the ImageReq is deleted, but not removed from the ic that was attached to above.
As a result, there's a dangling pointer left in the ic that we hit later when
cleaning up this group context. The failure code should remove this dangling
pointer.

2070     url = ic->net_cx->CreateURL(image_url, cache_reload_policy);
2071
2072     if (!url)
2073     {
2074 #ifndef M12N /* XXXM12N fix me. */
2075         /* xxx clean up previously allocated objects */
2076         return MK_OUT_OF_MEMORY;
2077 #else
2078         NS_RELEASE(image_req->net_cx);
2079         PR_FREEIF(image_req);
2080         return NULL;
2081 #endif /* M12N */
2082     }

Comment 1

[pnunn]

Thanks for catching that Vidur.
-pn

Comment 2

[pnunn]

It looks like this also a problem there is a bug creating a new NetReader or
creating a net context for the image request.
-pn

Comment 3

[pnunn]

Used il_delete_client() to clean up. In 3 places, where image_req creation
fails in IL_GetImage().
-pn

Comment 4

[Eli Goldberg]

Vidur,

Would you like to confirm that this is fixed to your satisfaction, or should I
just rubber-stamp it as verified?

Thanks!

Comment 5

[vidur (gone)]

I trust Pam on this. Rubber-stamp it!

Comment 6

[Eli Goldberg]

Boing! Rubber-stamped verified. Thanks!