Closed Bug 880392 Opened 7 years ago Closed 7 years ago

GC: fix exact rooting in XPCShell

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla24

People

(Reporter: terrence, Assigned: terrence)

References

Details

Attachments

(1 file)

XPCShell's main function has code like:

{
  Rooted<> envobj(cx, ...);
  ...
  JS_DestroyContext(cx);
}

Naturally, when ~envobj fires, |stack| is dead because the cx has been destroyed. 

This is currently preventing debug builds on tbpl from completing because this crashes when generating the stage packages. Opt builds appear to "work" because we don't poison on free() -- it's just a use-after-free.
Assignee: general → terrence
Status: NEW → ASSIGNED
Attachment #759483 - Flags: review?(sphink)
Attachment #759483 - Flags: review?(sphink) → review+
https://hg.mozilla.org/mozilla-central/rev/29363d0fd7ff
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla24
You need to log in before you can comment on or make changes to this bug.