871317 - Fix more rooting hazards in the storage code

Status: RESOLVED FIXED

(Core :: SQLite and Embedded Database Bindings, defect)

Description

[(no longer active)]

Attachment: Patch (v1)

Function 'uint32 mozilla::storage::StatementJSHelper::GetProperty(nsIXPConnectWrappedNative*, JSContext*, JSObject*, jsid, JS::Value*, uint8*)' has unrooted 'aScopeObj' of type 'JSObject*' live across GC call 'nsCOMPtr<T>::nsCOMPtr(nsQueryInterface) [with T = mozIStorageStatement]' at storage/src/mozStorageStatementJSHelper.cpp:191
    storage/src/mozStorageStatementJSHelper.cpp:185: Assign(1,2, __temp_2 := aId*)
    storage/src/mozStorageStatementJSHelper.cpp:185: Call(2,3, __temp_1 := JSID_IS_STRING(__temp_2*))
    storage/src/mozStorageStatementJSHelper.cpp:185: Assume(3,5, (__temp_1* == 0), false)
    storage/src/mozStorageStatementJSHelper.cpp:191: Call(5,6, __temp_4 := aWrapper*.Native())
    storage/src/mozStorageStatementJSHelper.cpp:191: Call(6,7, __temp_3 := do_QueryInterface(__temp_4*))
    storage/src/mozStorageStatementJSHelper.cpp:191: Call(7,8, isStatement.nsCOMPtr(__temp_3*))
    storage/src/mozStorageStatementJSHelper.cpp:192: Call(8,9, isStatement.~nsCOMPtr())
    storage/src/mozStorageStatementJSHelper.cpp:197: Call(9,10, stmt := aWrapper*.Native())
    storage/src/mozStorageStatementJSHelper.cpp:200: Call(10,11, __temp_5*.GuardObjectNotifier(0))
    storage/src/mozStorageStatementJSHelper.cpp:200: Call(11,12, scope.Rooted(aCtx*,aScopeObj*,__temp_5))

Function 'uint32 mozilla::storage::StatementJSHelper::GetProperty(nsIXPConnectWrappedNative*, JSContext*, JSObject*, jsid, JS::Value*, uint8*)' has unrooted 'aId' of type 'jsid' live across GC call 'nsCOMPtr<T>::nsCOMPtr(nsQueryInterface) [with T = mozIStorageStatement]' at storage/src/mozStorageStatementJSHelper.cpp:191
    storage/src/mozStorageStatementJSHelper.cpp:185: Call(2,3, __temp_1 := JSID_IS_STRING(__temp_2*))
    storage/src/mozStorageStatementJSHelper.cpp:185: Assume(3,5, (__temp_1* == 0), false)
    storage/src/mozStorageStatementJSHelper.cpp:191: Call(5,6, __temp_4 := aWrapper*.Native())
    storage/src/mozStorageStatementJSHelper.cpp:191: Call(6,7, __temp_3 := do_QueryInterface(__temp_4*))
    storage/src/mozStorageStatementJSHelper.cpp:191: Call(7,8, isStatement.nsCOMPtr(__temp_3*))
    storage/src/mozStorageStatementJSHelper.cpp:192: Call(8,9, isStatement.~nsCOMPtr())
    storage/src/mozStorageStatementJSHelper.cpp:197: Call(9,10, stmt := aWrapper*.Native())
    storage/src/mozStorageStatementJSHelper.cpp:200: Call(10,11, __temp_5*.GuardObjectNotifier(0))
    storage/src/mozStorageStatementJSHelper.cpp:200: Call(11,12, scope.Rooted(aCtx*,aScopeObj*,__temp_5))
    storage/src/mozStorageStatementJSHelper.cpp:200: Call(12,13, __temp_5.~GuardObjectNotifier())
    storage/src/mozStorageStatementJSHelper.cpp:201: Assign(13,14, __temp_6 := aId*)

Comment 1

[Till Schneidereit [:till]]

Comment on attachment 748587 [details] [diff] [review]
Patch (v1)

Review of attachment 748587 [details] [diff] [review]:
-----------------------------------------------------------------

I don't understand why these had to be moved up, but sure :)

::: storage/src/mozStorageStatementJSHelper.cpp
@@ +184,5 @@
>  {
>    if (!JSID_IS_STRING(aId))
>      return NS_OK;
>  
> +  JS::RootedObject scope(aCtx, aScopeObj);

JS::Rooted< ...

@@ +185,5 @@
>    if (!JSID_IS_STRING(aId))
>      return NS_OK;
>  
> +  JS::RootedObject scope(aCtx, aScopeObj);
> +  JS::RootedId id(aCtx, aId);

and here

Comment 2

[(no longer active)]

(In reply to Till Schneidereit [:till] from comment #1)
> Comment on attachment 748587 [details] [diff] [review]
> Patch (v1)
> 
> Review of attachment 748587 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> I don't understand why these had to be moved up, but sure :)

Because it seems like the nsCOMPtr dtor run in the debug only code there can also trigger GC, AFAICT.

Comment 3

[(no longer active)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/999cf4e87d11

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/999cf4e87d11