Fix rooting in JSArray creation for mozTelephony

RESOLVED FIXED in mozilla17

Status

()

Core
DOM: Device Interfaces
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: qdot, Assigned: qdot)

Tracking

Trunk
mozilla17
x86_64
All
Points:
---

Firefox Tracking Flags

(blocking-basecamp:+)

Details

Attachments

(1 attachment)

(Assignee)

Description

5 years ago
There are functions in mozTelephony and mozBluetooth that convery nsTArrays to JSArrays. The internal machinery moves values to an internal nsTArray that's then tranformed as part of JS_NewArrayObject. There could be a GC sweep during this conversion that could cause some of the values to be swept before rooting.
Hm do we also need a write barrier now with IGC?
(Assignee)

Updated

5 years ago
Assignee: nobody → kyle
Blocks: 727618, 710489
Kyle, Gregor: Does this need to block the release?
blocking-basecamp: --- → ?
(Assignee)

Updated

5 years ago
No longer blocks: 727618
(Assignee)

Updated

5 years ago
Summary: Fix rooting in JSArray creation for mozTelephony/mozBluetooth → Fix rooting in JSArray creation for mozTelephony
(Assignee)

Comment 3

5 years ago
Nope, this doesn't block release. It's already fixed in 761511 for bluetooth, too.
(Assignee)

Comment 4

5 years ago
Created attachment 648098 [details] [diff] [review]
Patch 1 (v1): Fix rooting in JSArray creation for mozTelephony
Attachment #648098 - Flags: review?(bent.mozilla)
Attachment #648098 - Flags: review?(bent.mozilla) → review+
(Assignee)

Comment 5

5 years ago
http://hg.mozilla.org/integration/mozilla-inbound/rev/935501afee09
Target Milestone: --- → mozilla17
https://hg.mozilla.org/mozilla-central/rev/935501afee09
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Potential crasher so blocking in case we regress.
blocking-basecamp: ? → +
You need to log in before you can comment on or make changes to this bug.