811369 - Prevent AudioBuffer from double-dropping JS objects

Status: RESOLVED WONTFIX

(Core :: Web Audio, defect)

Description

[(no longer active)]

There is a scenario where AudioBuffer can double-drop its JS objects, if Unlink gets called first and then the destructor gets called.  We need to protect against this.

Comment 1

[(no longer active)]

Attachment: Patch (v1)

Comment 2

[Andrew McCreight [:mccr8]]

This is a bit tricky because we only get the double-drop if it is Unlinked when it is preserved. If it is Unlinked when it isn't preserved, then we still need to drop in the destructor, so I think checking mContext isn't enough. :(

Comment 3

[Andrew McCreight [:mccr8]]

This is why I didn't comment on it when I noticed it, because we're probably affected by this in any wrapper cached class that has other JS pointers, and there's no good way to fix it in the class itself.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 681120 [details] [diff] [review]
Patch (v1)

Yeah, this isn't right on its own.  :(

Comment 5

[(no longer active)]

So, what needs to be done here?  (Also, Boris, did you mean to r+ the patch?)

Comment 6

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 681120 [details] [diff] [review]
Patch (v1)

Er, no.  I did not.

What needs to be done depends on what happens in bug 811206.

Comment 7

[Andrew McCreight [:mccr8]]

Double dropping should be okay now that bug 811206 has landed.

Comment 8

[(no longer active)]

Mass moving Web Audio bugs to the Web Audio component.  Filter on duckityduck.