Prevent AudioBuffer from double-dropping JS objects

RESOLVED WONTFIX

Status

()

defect
RESOLVED WONTFIX
7 years ago
6 years ago

People

(Reporter: Ehsan, Assigned: Ehsan)

Tracking

Trunk
x86
macOS
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

Assignee

Description

7 years ago
There is a scenario where AudioBuffer can double-drop its JS objects, if Unlink gets called first and then the destructor gets called.  We need to protect against this.
Assignee

Comment 1

7 years ago
Posted patch Patch (v1)Splinter Review
Assignee: nobody → ehsan
Status: NEW → ASSIGNED
Attachment #681120 - Flags: review?(bzbarsky)
This is a bit tricky because we only get the double-drop if it is Unlinked when it is preserved. If it is Unlinked when it isn't preserved, then we still need to drop in the destructor, so I think checking mContext isn't enough. :(
This is why I didn't comment on it when I noticed it, because we're probably affected by this in any wrapper cached class that has other JS pointers, and there's no good way to fix it in the class itself.
Comment on attachment 681120 [details] [diff] [review]
Patch (v1)

Yeah, this isn't right on its own.  :(
Attachment #681120 - Flags: review?(bzbarsky) → review+
Assignee

Comment 5

7 years ago
So, what needs to be done here?  (Also, Boris, did you mean to r+ the patch?)
Comment on attachment 681120 [details] [diff] [review]
Patch (v1)

Er, no.  I did not.

What needs to be done depends on what happens in bug 811206.
Attachment #681120 - Flags: review+ → review-
Assignee

Updated

7 years ago
Depends on: 811206
No longer depends on: 811206
Depends on: 811206
Double dropping should be okay now that bug 811206 has landed.
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → WONTFIX
Assignee

Comment 8

6 years ago
Mass moving Web Audio bugs to the Web Audio component.  Filter on duckityduck.
Component: Video/Audio → Web Audio
You need to log in before you can comment on or make changes to this bug.