GC: fix exact rooting in XPCShell

RESOLVED FIXED in mozilla24

Status

()

RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: terrence, Assigned: terrence)

Tracking

Trunk
mozilla24
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

5 years ago
XPCShell's main function has code like:

{
  Rooted<> envobj(cx, ...);
  ...
  JS_DestroyContext(cx);
}

Naturally, when ~envobj fires, |stack| is dead because the cx has been destroyed. 

This is currently preventing debug builds on tbpl from completing because this crashes when generating the stage packages. Opt builds appear to "work" because we don't poison on free() -- it's just a use-after-free.
(Assignee)

Comment 1

5 years ago
Created attachment 759483 [details] [diff] [review]
v0: tested and verified working
Assignee: general → terrence
Status: NEW → ASSIGNED
Attachment #759483 - Flags: review?(sphink)
Attachment #759483 - Flags: review?(sphink) → review+

Comment 3

5 years ago
https://hg.mozilla.org/mozilla-central/rev/29363d0fd7ff
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla24
You need to log in before you can comment on or make changes to this bug.