Last Comment Bug 645442 - XPCWrappedNative::FlatJSObjectFinalized manipulates map without acquiring map lock
: XPCWrappedNative::FlatJSObjectFinalized manipulates map without acquiring map...
Status: RESOLVED FIXED
[fixed by bug 629610]
:
Product: Core
Classification: Components
Component: XPConnect (show other bugs)
: Trunk
: All All
: -- normal (vote)
: mozilla6
Assigned To: David Baron :dbaron: ⌚️UTC-8
:
: Andrew Overholt [:overholt]
Mentors:
Depends on: 629610
Blocks:
  Show dependency treegraph
 
Reported: 2011-03-26 21:54 PDT by David Baron :dbaron: ⌚️UTC-8
Modified: 2011-04-19 03:09 PDT (History)
5 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description David Baron :dbaron: ⌚️UTC-8 2011-03-26 21:54:07 PDT
XPCWrappedNative::FlatJSObjectFinalized has the following code (which I noticed while further investigating bug 629610 comment 312):

        GetScope()->GetWrappedNativeMap()->Remove(this);

This seems to be the one of the very few things that manipulates a Native2WrappedNativeMap without acquiring the map lock.  (I was noticing because I was comparing the code there to ~XPCWrappedNative, which is very similar, but does acquire the map lock.)

The other things (which worry me somewhat less) are:

XPCWrappedNativeScope::MarkAllWrappedNativesAndProtos, XPCWrappedNativeScope::ASSERT_NoInterfaceSetsAreMarked, and XPCWrappedNativeScope::SweepAllWrappedNativeTearOffs, which all run under the JSGC_FINALIZE_END callback (though maybe that doesn't really help?).

XPCWrappedNativeScope::DebugDump, which is #ifdef DEBUG.
Comment 1 David Baron :dbaron: ⌚️UTC-8 2011-04-03 12:12:27 PDT
The patch I put in bug 629610 fixes this.

Note You need to log in before you can comment on or make changes to this bug.