Fix rooting in JSArray creation for mozTelephony

RESOLVED FIXED in mozilla17

Status

()

Core
DOM: Device Interfaces
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: qdot, Assigned: qdot)

Tracking

Trunk
mozilla17
x86_64
All
Points:
---

Firefox Tracking Flags

(blocking-basecamp:+)

Details

Attachments

(1 attachment)

There are functions in mozTelephony and mozBluetooth that convery nsTArrays to JSArrays. The internal machinery moves values to an internal nsTArray that's then tranformed as part of JS_NewArrayObject. There could be a GC sweep during this conversion that could cause some of the values to be swept before rooting.
Hm do we also need a write barrier now with IGC?
Assignee: nobody → kyle
Blocks: 727618, 710489
Kyle, Gregor: Does this need to block the release?
blocking-basecamp: --- → ?
No longer blocks: 727618
Summary: Fix rooting in JSArray creation for mozTelephony/mozBluetooth → Fix rooting in JSArray creation for mozTelephony
Nope, this doesn't block release. It's already fixed in 761511 for bluetooth, too.
Created attachment 648098 [details] [diff] [review]
Patch 1 (v1): Fix rooting in JSArray creation for mozTelephony
Attachment #648098 - Flags: review?(bent.mozilla)
Attachment #648098 - Flags: review?(bent.mozilla) → review+
http://hg.mozilla.org/integration/mozilla-inbound/rev/935501afee09
Target Milestone: --- → mozilla17

Comment 6

5 years ago
https://hg.mozilla.org/mozilla-central/rev/935501afee09
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Potential crasher so blocking in case we regress.
blocking-basecamp: ? → +
You need to log in before you can comment on or make changes to this bug.