794365 - Valgrind on tbpl detects leak - 4 bytes are definitely lost (direct) with JSInlineString::uninline on the stack

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: m-c changeset 08d435dedc7f Valgrind stack with line numbers

Valgrind detects a leak of 4 bytes (direct) with XPCConvert::JSData2Native on the stack, see attached snippet which comes from:

https://tbpl.mozilla.org/php/getParsedLog.php?id=15521837&tree=Firefox&full=1

Guessing Core: XPConnect, please change component if necessary.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

It's probably Core: JavaScript Engine since JSInlineString::uninline is the common function among similar stacks.

Comment 2

[Terrence Cole [:terrence]]

Attachment: testcase

Comment 3

[Terrence Cole [:terrence]]

Attachment: v0: fix

Comment 4

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 665119 [details] [diff] [review]
v0: fix

Review of attachment 665119 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/vm/String.cpp
@@ +514,5 @@
> +    for (uint32_t i = 0; i < NUM_SMALL_CHARS * NUM_SMALL_CHARS; i++)
> +        length2StaticTable[i] = NULL;
> +
> +    for (uint32_t i = 0; i < INT_STATIC_LIMIT; i++)
> +        intStaticTable[i] = NULL;

Probably easier to use PodArrayZero as is done in the StaticStrings constructor. Or you could just factor that code out.

Comment 5

[Terrence Cole [:terrence]]

Oh, good idea!

https://hg.mozilla.org/integration/mozilla-inbound/rev/898ae4d394b3

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/898ae4d394b3

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

A type of test for this bug has already been landed because it is already marked in-testsuite+ -> VERIFIED.