940754 - Fix rooting hazard in WorkerPrivateParent::WrapObject()

Status: RESOLVED FIXED

(Core :: DOM: Workers, defect)

Description

[Jon Coppeard (:jonco)]

Attachment: root-wrap-object

Currently this has a live JSObject* over a call to nsWrapperCache::PreserveWrapper(), which can GC.

The fix is just to root this object.

Comment 1

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Why can PreserveWrapper GC?

Comment 2

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Comment on attachment 8334930 [details] [diff] [review]
root-wrap-object

Review of attachment 8334930 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks!

Comment 3

[Boris Zbarsky [:bzbarsky]]

> Why can PreserveWrapper GC?

Probably the virtual QI calls which can in theory call into script in general (but probably don't for things that inherit from nsWrapperCache)?

Comment 4

[Jon Coppeard (:jonco)]

(In reply to Boris Zbarsky [:bz] from comment #3)

Yes, it's the QueryInterface the analysis complains about.

Comment 5

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/db0f8a5eeb33

Comment 6

[Ed Morley [:emorley]]

Unfortunately this and the other bugs in https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?changeset=db0f8a5eeb33 have been backed out for causing rootanalysis assertions, eg:
https://tbpl.mozilla.org/php/getParsedLog.php?id=30835010&tree=Mozilla-Inbound

Backout:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?changeset=05a0228c2caa

(For quick relanding, I recommend the third party qbackout extension and '--apply' mode)

Comment 7

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e00d889fc72e

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/e00d889fc72e