Closed
Bug 1004276
Opened 11 years ago
Closed 8 years ago
Assert that we do not GC in the middle of a CC slice
Categories
(Core :: XPCOM, defect)
Core
XPCOM
Tracking
()
RESOLVED
FIXED
mozilla51
| Tracking | Status | |
|---|---|---|
| firefox51 | --- | fixed |
People
(Reporter: terrence, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: sec-audit, Whiteboard: [post-critsmash-triage][adv-main51-])
Attachments
(1 file, 1 obsolete file)
|
(deleted),
patch
|
terrence
:
review+
|
Details | Diff | Splinter Review |
After some feedback from :mccr8, this was able to browse around techcrunch, cnn, and passed octane. I'd like to push this to try, but bug 994028.
Attachment #8415644 -
Flags: review?(continuation)
|
||
Updated•11 years ago
|
Attachment #8415644 -
Flags: review?(continuation) → review+
|
|
||
Updated•11 years ago
|
Group: core-security
|
Reporter | |
Updated•10 years ago
|
Blocks: GC.stability
|
||
Updated•9 years ago
|
Group: core-security → dom-core-security
|
|
Reporter | |
Comment 2•8 years ago
|
||
I know we have assertions on insertion into the GraphBuilder that the nodes we're adding are not in the nursery, so I think that this is not actually a problem in practice. That said, I have no idea *why* that assertion passes. We can certainly GC after building the graph during Unlink (we run JS there), but I guess the graph is already gone by then? I'm not sure how we keep compacting from ruining our world in that case.
Either way we need more assertions around this interaction. I think the patch attached here is a good starting place, but I'd also like assertion on Heap<T>::get that we are not in one of these regions -- e.g. that we do not try to ExposeToActiveJS in the middle of deleting stuff from the CC.
Assignee: terrence → nobody
Status: ASSIGNED → NEW
|
|
Reporter | |
Comment 3•8 years ago
|
||
|
|
Reporter | |
Comment 4•8 years ago
|
||
Rebased. We renamed the method and stuff moved around a bit in the CC.
Attachment #8415644 -
Attachment is obsolete: true
Attachment #8790464 -
Flags: review+
|
|
Reporter | |
Updated•8 years ago
|
|
|
Reporter | |
Comment 5•8 years ago
|
||
|
|
Reporter | |
Comment 6•8 years ago
|
||
|
|
Reporter | |
Comment 7•8 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/b1df9ae6cce2e3766c7d9c7521a32b5e6bfb7161
Bug 1004276 - Assert that we do not GC in the wrong parts of the CC; r=mccr8
Status: NEW → RESOLVED
Closed: 8 years ago
status-firefox51:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla51
|
|
||
Updated•8 years ago
|
Group: dom-core-security → core-security-release
|
||
Updated•8 years ago
|
Flags: qe-verify-
Whiteboard: [post-critsmash-triage]
|
||
Updated•8 years ago
|
Whiteboard: [post-critsmash-triage] → [post-critsmash-triage][adv-main51-]
|
|
||
Updated•7 years ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•