722771 - PreciseGCRunnable.mCx can be deleted before the runnable runs

Status: RESOLVED INACTIVE

(Core :: XPConnect, defect)

Description

[Jesse Ruderman]

Attachment: gdb output

The mCx field of a PreciseGCRunnable can become dangling if the window is closed. With MallocScribble=1, this will usually crash [@ JSRuntime::onOwnerThread].

The testcase from the fuzzer looks something like this, but I had trouble reducing it all the way.

  fuzzPriv.schedulePreciseGC();
  window.open("data:text/html,1");
  fuzzPriv.closeTabThenQuit();

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Is there any reason we can't just use the safe JS context here?

Comment 2

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.