639477 - Dictionary tracer can crash

Status: RESOLVED FIXED

(Tamarin Graveyard :: Garbage Collection (mmGC), defect, P1)

Description

[Tommy Reilly]

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   ...dia.FlashPlayer-10.6.plugin	0x21d78275 avmplus::ScriptObject::gcTrace(MMgc::GC*, unsigned long) + 197 (avmplusHashtable-inlines.h:153)
1   ...dia.FlashPlayer-10.6.plugin	0x2199d836 avmplus::DictionaryObject::gcTrace(MMgc::GC*, unsigned long) + 38 (DictionaryGlue.h:77)
2   ...dia.FlashPlayer-10.6.plugin	0x21e00862 MMgc::GC::MarkItem(MMgc::GCWorkItem&) + 658 (GC.cpp:2310)
3   ...dia.FlashPlayer-10.6.plugin	0x21e0131c MMgc::GC::TraceConservativePointer(unsigned long, bool) + 684 (GC.cpp:2482)
4   ...dia.FlashPlayer-10.6.plugin	0x21e00806 MMgc::GC::MarkItem(MMgc::GCWorkItem&) + 566 (GC.cpp:2379)
5   ...dia.FlashPlayer-10.6.plugin	0x21e013db MMgc::GC::Mark() + 91 (GCStack.h:333)
6   ...dia.FlashPlayer-10.6.plugin	0x21e016f6 MMgc::GC::DoMarkFromStack(void*, void*) + 102 (GC.cpp:1291)
7   ...dia.FlashPlayer-10.6.plugin	0x21dc8d50 CallWithRegistersSaved2(void (*)(void*, void*), void*, void*) + 32 (PosixPortUtils.cpp:300)
8   ...dia.FlashPlayer-10.6.plugin	0x21e0b67f VMPI_callWithRegistersSaved(void (*)(void*, void*), void*) + 47 (MMgcPortMac.cpp:278)
9   ...dia.FlashPlayer-10.6.plugin	0x21e01da0 MMgc::GC::FinishIncrementalMark(bool) + 128 (GC.cpp:2752)
10  ...dia.FlashPlayer-10.6.plugin	0x21e02010 MMgc::GC::CollectionWork() + 80 (GC.cpp:582)
11  ...dia.FlashPlayer-10.6.plugin	0x21e04b08 MMgc::GCAlloc::Alloc(int) + 136 (GC-inlines.h:110)
12  ...dia.FlashPlayer-10.6.plugin	0x21d35e67 avmplus::InlineHashtable::initialize(MMgc::GC*, int) + 135 (avmplusHashtable.cpp:69)
13  ...dia.FlashPlayer-10.6.plugin	0x21883881 avmplus::DictionaryObject::init(bool) + 129 (avmplusHashtable-inlines.h:354)

Comment 1

[Tommy Reilly]

gcTrace uses getTableNoInit, if its a Dictionary getTableNoInit ASSUMES the dictionary has already allocated and stored a pointer to its table but as this show that isn't the case so callers of getTableNoInit need to null check the return value and ScriptObject::gcTrace doesn't.

Comment 2

[Lars T Hansen]

Bonus points for documenting this in the Dictionary code if it's not already there.

Comment 3

[Tommy Reilly]

Attachment: A null check and some comments

Comment 4

[Lars T Hansen]

Comment on attachment 517418 [details] [diff] [review]
A null check and some comments

Nice.

Comment 5

[Tommy Reilly]

Attachment: Same patch forgot to qref to pick up trivial typo fix.

Comment 6

[Tamarin Bot]

changeset: 6049:82ceb3de5b8c
user:      Tommy Reilly <[e-mail]>
summary:   Bug 639477 - Dictionary tracer can crash (r=lhansen)

http://hg.mozilla.org/tamarin-redux/rev/82ceb3de5b8c