Closed Bug 968542 Opened 8 years ago Closed 8 years ago

IPC blobs can entrain a ContentParent

Categories

(Core :: DOM: Core & HTML, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla30
blocking-b2g 1.3+
Tracking Status
firefox28 --- wontfix
firefox29 --- wontfix
firefox30 --- fixed
b2g-v1.3 --- fixed
b2g-v1.3T --- fixed
b2g-v1.4 --- fixed

People

(Reporter: khuey, Assigned: khuey)

References

Details

(Whiteboard: [MemShrink])

Attachments

(1 file, 2 obsolete files)

Attached patch Patc (obsolete) — Splinter Review
Something I've noticed while debugging Bug 963290 is that IPC Blobs can entrain the ContentParent.  I don't think we can rely on the page allowing the blob to be GCd, but I'm not 100% convinced that this is the right fix.
Attachment #8371130 - Flags: review?(bent.mozilla)
Whiteboard: [MemShrink]
Comment on attachment 8371130 [details] [diff] [review]
Patc

Review of attachment 8371130 [details] [diff] [review]:
-----------------------------------------------------------------

I think this looks fine! Except:

::: dom/ipc/Blob.cpp
@@ +954,5 @@
>        MOZ_ASSERT(mActor);
>        MOZ_ASSERT(!mSlice);
>        MOZ_ASSERT(!mDone);
>  
> +      NS_ENSURE_TRUE(mActor->Manager(), NS_ERROR_UNEXPECTED);

This is a void function
Attachment #8371130 - Flags: review?(bent.mozilla) → review+
Attached patch Patch, fixed per review comment. (obsolete) — Splinter Review
Fixed up, ready to land. Carrying over bent's r+. (and I would've landed this had the tree been open)
Attachment #8372666 - Flags: review+
Attachment #8372666 - Flags: checkin?
Now with checkin comment etc.
Attachment #8372666 - Attachment is obsolete: true
Attachment #8372666 - Flags: checkin?
Attachment #8372668 - Flags: review+
Attachment #8372668 - Flags: checkin?
Attachment #8371130 - Attachment is obsolete: true
Comment on attachment 8372668 [details] [diff] [review]
Patch, fixed per review comment.

Please just use checkin-needed ;)
Attachment #8372668 - Flags: checkin? → checkin+
Will do! (too many flags to keep track of) Thanks for landing this!
https://hg.mozilla.org/mozilla-central/rev/930f356f1a36
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Flags: in-testsuite-
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.