952183 - reuseGlobal doesn't account for scripts being recycled

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: table-script-recycling-fix

This seems like it's probably causing the issues in bug 673569. Gregor has kindly agreed to test.

Comment 1

[Gregor Wagner [:gwagner]]

Comment on attachment 8350159 [details] [diff] [review]
table-script-recycling-fix

It works \o/. Please land asap.

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 8350159 [details] [diff] [review]
table-script-recycling-fix

Not sure who's around to review right now. Whoever gets to this first wins.

It sounds like Blake already figured this out. The problem was that scripts were getting collected, but they still remained in mThisObjects. Then FindTargetObject would get here:

http://mxr.mozilla.org/mozilla-central/source/js/xpconnect/loader/mozJSComponentLoader.cpp#528

If the result of GetOutermostEnclosingFunctionOfScriptedCaller happened to have the same address as something that was in the table and then recycled, we would get the wrong target object.

Comment 3

[Gregor Wagner [:gwagner]]

Please land on mc directly so that travis can pick up the new build.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 8350159 [details] [diff] [review]
table-script-recycling-fix

I think I marked the wrong request as r=me... resetting this to khuey so he can look when he gets a chance.

Comment 5

[Gregor Wagner [:gwagner]]

Any sheriffs around that can land this on mc?

Comment 6

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/mozilla-central/rev/95588faa95b5

I'll just watch the tree.