876805 - Fix unsafe reference hazards in dom/ code

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Boris Zbarsky [:bzbarsky]]

Most of these seem to be real issues.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix unsafe reference gc hazards in dom/ code.

Comment 2

[Boris Zbarsky [:bzbarsky]]

I think that leaves the following unsafe references in dom/ code:

dom/plugins/base/nsJSNPRuntime.cpp:534 -- False positive, I think, due to
                                          virtual hashtable ops. We could try to
                                          rearrange code to make it not so, but
                                          it's hard.
dom/plugins/base/nsJSNPRuntime.cpp:1025 -- same
dom/workers/EventListenerManager.cpp:362 -- false positive for nsAutoJSValHolder, I think

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 754982 [details] [diff] [review]
Fix unsafe reference gc hazards in dom/ code.

I wonder if there was some other way to do 
JS::Rooted<JS::Value> undef(cx, JS::UndefinedValue()); ...

Comment 4

[Boris Zbarsky [:bzbarsky]]

For what it's worth, that code dies in bug 877281.

Thanks for the review!

Comment 5

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f327a0802164

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/f327a0802164