IonMonkey: Rooting error in IonCompartment::generateVMWrapper

RESOLVED INVALID

Status

()

RESOLVED INVALID
6 years ago
6 years ago

People

(Reporter: djvj, Unassigned)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

6 years ago
The following code shows up in generateVMWrapper() (in all Trampoline-ARCH.cpp files):

    Linker linker(masm);
    IonCode *wrapper = linker.newCode(cx);
    if (!wrapper)
        return NULL;

    // linker.newCode may trigger a GC and sweep functionWrappers_ so we have to
    // use relookupOrAdd instead of add.
    if (!functionWrappers_->relookupOrAdd(p, &f, wrapper))
        return NULL;

    return wrapper;

If relookupOrAdd causes a GC while, say, reallocating the hash table, then |wrapper| is not rooted and seems like it may get collected.
Note that malloc cannot cause a GC, and neither can relookupOrAdd.
(Reporter)

Comment 2

6 years ago
Thanks Bill.  Marking as invalid.
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.