868266 - Root the arguments array in nsObjectLoadingContent::LegacyCall

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Boris Zbarsky [:bzbarsky]]

Spinning this off into a separate bug, because I think we want it on Aurora: it's a GC hazard even with our current GC setup.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Root the arguments list in nsObjectLoadingContent::LegacyCall.

Comment 2

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c2b32320a79f

Comment 3

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 744950 [details] [diff] [review]
Root the arguments list in nsObjectLoadingContent::LegacyCall.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Bug 827158
User impact if declined: A GC hazard that may end up being exploitable if one
   tries hard enough.
Testing completed (on m-c, etc.): Passes tests and all.
Risk to taking this patch (and alternatives if risky): Very low risk: just adds
   on-stack rooting.  The other options are to do nothing or to turn off WebIDL
   bindings for object/embed/applet, but the latter is riskier than this patch.
String or IDL/UUID changes made by this patch:  None.

Comment 4

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/c2b32320a79f

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/b5373e1f83b2