There is a scenario where AudioBuffer can double-drop its JS objects, if Unlink gets called first and then the destructor gets called. We need to protect against this.
Assignee: nobody → ehsan
Status: NEW → ASSIGNED
Attachment #681120 - Flags: review?(bzbarsky)
This is a bit tricky because we only get the double-drop if it is Unlinked when it is preserved. If it is Unlinked when it isn't preserved, then we still need to drop in the destructor, so I think checking mContext isn't enough. :(
This is why I didn't comment on it when I noticed it, because we're probably affected by this in any wrapper cached class that has other JS pointers, and there's no good way to fix it in the class itself.
Comment on attachment 681120 [details] [diff] [review] Patch (v1) Yeah, this isn't right on its own. :(
Attachment #681120 - Flags: review?(bzbarsky) → review+
So, what needs to be done here? (Also, Boris, did you mean to r+ the patch?)
Comment on attachment 681120 [details] [diff] [review] Patch (v1) Er, no. I did not. What needs to be done depends on what happens in bug 811206.
Attachment #681120 - Flags: review+ → review-
Double dropping should be okay now that bug 811206 has landed.
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → WONTFIX
Mass moving Web Audio bugs to the Web Audio component. Filter on duckityduck.
Component: Video/Audio → Web Audio
You need to log in before you can comment on or make changes to this bug.