E4X uses a non-RC write barrier to overwrite a field holding an RCObject

VERIFIED FIXED in Q3 11 - Serrano

Status

Tamarin
Garbage Collection (mmGC)
P1
normal
VERIFIED FIXED
7 years ago
7 years ago

People

(Reporter: Tommy Reilly, Unassigned)

Tracking

unspecified
Q3 11 - Serrano
Bug Flags:
in-testsuite +
flashplayer-bug +

Details

(Whiteboard: WE 2782377)

Attachments

(3 attachments)

(Reporter)

Description

7 years ago
Created attachment 494710 [details] [diff] [review]
clear it

need to clear with a RC write barrier first
Attachment #494710 - Flags: review?(lhansen)
(Reporter)

Updated

7 years ago
Blocks: 525875
(Reporter)

Updated

7 years ago
Assignee: nobody → treilly
Status: NEW → ASSIGNED

Comment 1

7 years ago
Comment on attachment 494710 [details] [diff] [review]
clear it

(Ravings about awful hacks mostly elided.)
Attachment #494710 - Flags: review?(lhansen) → review+
(Reporter)

Comment 2

7 years ago
The idea of a template, ie:

GCMember<Stringp, E4XNodeAux> m_nameOrAux;

has come up before.  Which would take care of all these details under the covers (including any bit twiddling).
(Reporter)

Comment 3

7 years ago
http://hg.mozilla.org/tamarin-redux/rev/d7ab3108d0fc
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED

Updated

7 years ago
Flags: flashplayer-bug+

Comment 4

7 years ago
Created attachment 526797 [details] [diff] [review]
One more place needs WBRC_NULL

WE #2782377 surfaced it up.
Attachment #526797 - Flags: superreview?(lhansen)
Attachment #526797 - Flags: review?(treilly)

Updated

7 years ago
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
(Reporter)

Updated

7 years ago
Attachment #526797 - Flags: review?(treilly) → review+

Comment 5

7 years ago
Comment on attachment 526797 [details] [diff] [review]
One more place needs WBRC_NULL

We should expedite work on Tommy's idea for a structured way of dealing with these kinds of unions.
Attachment #526797 - Flags: superreview?(lhansen) → superreview+
(Reporter)

Comment 6

7 years ago
http://hg.mozilla.org/tamarin-redux/rev/de2739a7f6f6
Status: REOPENED → RESOLVED
Last Resolved: 7 years ago7 years ago
Resolution: --- → FIXED

Updated

7 years ago
Whiteboard: WE 2782377
(Reporter)

Comment 7

7 years ago
Re-opening, need acceptance tests that hit setNotification
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
(Reporter)

Updated

7 years ago
Assignee: treilly → nobody
Flags: in-testsuite-
(Reporter)

Comment 8

7 years ago
I set the in-testsuite flag to  a "-", reopened and reset assignee to default.  Hoping qe picks this up...

Comment 9

7 years ago
Created attachment 528308 [details] [diff] [review]
testcase

confirmed that with tr rev 6202 this testcase causes an assert to be thrown, and with 6203 it executes properly.
Attachment #528308 - Flags: review?(treilly)
(Reporter)

Updated

7 years ago
Attachment #528308 - Flags: review?(treilly) → review+

Comment 10

7 years ago
changeset: 6214:eeb68bddb214
user:      Brent Baker <brbaker@adobe.com>
summary:   Bug 616125: add testing around XML.setNotification() (r=treilly)

http://hg.mozilla.org/tamarin-redux/rev/eeb68bddb214
(Reporter)

Updated

7 years ago
Status: REOPENED → RESOLVED
Last Resolved: 7 years ago7 years ago
Resolution: --- → FIXED

Updated

7 years ago
Status: RESOLVED → VERIFIED
Flags: in-testsuite- → in-testsuite+

Comment 11

7 years ago
changeset: 6224:60f2e1775c0e
user:      Brent Baker <brbaker@adobe.com>
summary:   Bug 616125: skip testcase when recompiled with -ES

http://hg.mozilla.org/tamarin-redux/rev/60f2e1775c0e
You need to log in before you can comment on or make changes to this bug.