940727 - Fix rooting hazard in DOMProxyHandler::GetAndClearExpandoObject()

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Comment 1

[Jon Coppeard (:jonco)]

Attachment: fix-clear-expando-hazard

DOMProxyHandler::GetAndClearExpandoObject() calls xpc::GetObjectScope() so it can remove the object's expando object from it.  However, this can lazily create a compartment private, which can GC.  Not only that, we don't need to create this here anyway if it doesn't exist already.

The patch adds MaybeGetObjectScope() which doesn't bother creating the compartment private if it doesn't exist already, which avoids these issues.

Comment 2

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/17ca97e65aa5

Comment 3

[Ed Morley [:emorley]]

Unfortunately this and the other bugs in https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?changeset=db0f8a5eeb33 have been backed out for causing rootanalysis assertions, eg:
https://tbpl.mozilla.org/php/getParsedLog.php?id=30835010&tree=Mozilla-Inbound

Backout:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?changeset=05a0228c2caa

(For quick relanding, I recommend the third party qbackout extension and '--apply' mode)

Comment 4

[Jon Coppeard (:jonco)]

Relanding:

https://hg.mozilla.org/integration/mozilla-inbound/rev/9f517455f8f5

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/9f517455f8f5