865569 - Poison nsView

Status: RESOLVED FIXED

(Core :: Web Painting, enhancement)

Description

[Mats Palmgren (inactive)]

This is to mitigate crashes like bug 850571 to some degree,
and to make the crash more likely to occur so we can get STR.

Comment 1

[Mats Palmgren (inactive)]

Attachment: v1

This should help, but isn't bullet proof since we still allocate
nsView from the general heap.  Putting it in the pres arena would be
ideal, but would be more work since we need to have the shell in all
the new/delete places. 

https://tbpl.mozilla.org/?tree=Try&rev=02830a221ae6

Comment 2

[Mats Palmgren (inactive)]

Comment on attachment 741683 [details] [diff] [review]
v1

I tried to allocate nsView from the pres shell arena but that didn't work
because we create the root view before the shell in some cases.
And I suspect the root view may outlive the shell too.

Anyway, this patch should help a little bit.

Comment 3

[Mats Palmgren (inactive)]

Attachment: v2

No need for the MOZ_MALLOC conditionals -- just invoke operator delete
explicitly to deallocate.

https://tbpl.mozilla.org/?tree=Try&rev=6bd5129c87e6

Comment 4

[Mats Palmgren (inactive)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/91518747ca86

Comment 5

[Mats Palmgren (inactive)]

Comment on attachment 742693 [details] [diff] [review]
v2

This is to mitigate crashes like bug 850571 to some degree,
and to make that crash more likely to occur so we can get STR.
Low risk.

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/91518747ca86

Comment 7

[bhavana bajaj [:bajaj]]

Comment on attachment 742693 [details] [diff] [review]
v2

Approving this only on aurora at this point to see if it helps get the needed STR here. Holding off on beta approval as I do not want to a sudden crash spike in our final beta's while we are still getting results from this landing on aurora which may help understand the problem and get a low risk safe patch in time for Fx21 final Beta build(going to build next Monday 5/6) .

We will request users/QA to test the aurora build to see if they crash any sooner which may help here.

Comment 8

[Mats Palmgren (inactive)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/07a0fdee02ec

Comment 9

[bhavana bajaj [:bajaj]]

Comment on attachment 742693 [details] [diff] [review]
v2

I was holding off approval per comment #7.But given we have not see any STR and also as Bug 850571 is no longer a top-crasher, lets not rush this in our final beta.

Bug 868619 , is the tracking bug if we want to backout nsView poisoning on aurora/trunk.