Closed
Bug 1356305
Opened 8 years ago
Closed 8 years ago
stylo: heap write hazard from Gecko_MatchStringArgPseudo calling InitSystemMetrics
Categories
(Core :: CSS Parsing and Computation, defect, P1)
Core
CSS Parsing and Computation
Tracking
()
RESOLVED
FIXED
mozilla55
Tracking | Status | |
---|---|---|
firefox55 | --- | fixed |
People
(Reporter: sfink, Assigned: manishearth)
References
Details
Attachments
(1 file)
[24.05s] #50 Analyzing Gecko_MatchStringArgPseudo ...
Error: Variable assignment _ZL14sSystemMetrics$nsCSSRuleProcessor.cpp:nsTArray<nsCOMPtr<nsIAtom> >* sSystemMetrics
Location: _ZL17InitSystemMetricsv$nsCSSRuleProcessor.cpp:uint8 InitSystemMetrics() @ https://searchfox.org/mozilla-central/source/layout/style/nsCSSRuleProcessor.cpp#1069
Stack Trace:
_ZN18nsCSSRuleProcessor15HasSystemMetricEP7nsIAtom$uint8 nsCSSRuleProcessor::HasSystemMetric(nsIAtom*) @ https://searchfox.org/mozilla-central/source/layout/style/nsCSSRuleProcessor.cpp#1216
_ZN18nsCSSRuleProcessor19StringPseudoMatchesEPKN7mozilla3dom7ElementENS0_18CSSPseudoClassTypeEPKDsPK11nsIDocumentbNS0_11EventStatesEbPbSC_$uint8 nsCSSRuleProcessor::StringPseudoMatches(mozilla::dom::Element*, uint8, uint16*, nsIDocument*, uint8, mozilla::EventStates, uint8, uint8*, uint8*) @ https://searchfox.org/mozilla-central/source/layout/style/nsCSSRuleProcessor.cpp#1702 ### SafeArguments: <arg6> <arg7> <arg8>
Gecko_MatchStringArgPseudo @ https://searchfox.org/mozilla-central/source/layout/style/ServoBindings.cpp#586 ### SafeArguments: <arg3>
Comment hidden (mozreview-request) |
Assignee | ||
Updated•8 years ago
|
Assignee: nobody → manishearth
Updated•8 years ago
|
Priority: -- → P1
Comment hidden (mozreview-request) |
Assignee | ||
Comment 3•8 years ago
|
||
Comment 4•8 years ago
|
||
mozreview-review |
Comment on attachment 8858178 [details]
Bug 1356305 - stylo: Initialize system metrics before traversing
https://reviewboard.mozilla.org/r/130118/#review132784
r=me with those two fixes.
::: gfx/thebes/gfxUserFontSet.h:178
(Diff revision 2)
> friend class gfxUserFontEntry;
> friend class gfxOTSContext;
>
> public:
>
> - NS_INLINE_DECL_REFCOUNTING(gfxUserFontSet)
> + NS_INLINE_DECL_THREADSAFE_REFCOUNTING(gfxUserFontSet)
This should go away.
::: layout/style/nsCSSRuleProcessor.cpp:1064
(Diff revision 2)
> -static bool
> -InitSystemMetrics()
> +/* static */ bool
> +nsCSSRuleProcessor::InitSystemMetrics()
> {
> NS_ASSERTION(!sSystemMetrics, "already initialized");
>
> sSystemMetrics = new nsTArray< nsCOMPtr<nsIAtom> >;
> NS_ENSURE_TRUE(sSystemMetrics, false);
|new| is infallible now so this whole thing can become a void function.
Attachment #8858178 -
Flags: review+
Comment hidden (mozreview-request) |
Assignee | ||
Comment 6•8 years ago
|
||
Comment hidden (mozreview-request) |
Comment hidden (mozreview-request) |
Assignee | ||
Comment 9•8 years ago
|
||
We can't access prefs from nsLayoutStatics. Doing it in pre traverse instead
https://treeherder.mozilla.org/#/jobs?repo=try&revision=49452e83d081654da49eb413a32135e0c5b3ad56
Comment hidden (mozreview-request) |
Comment hidden (mozreview-request) |
Assignee | ||
Comment 12•8 years ago
|
||
I changed the way I'm handling this since we can't do pref access in nsLayoutStatics, need re-review.
Also, r?sfink on the analysis change. I don't think I can teach the analysis that we always call this function before traversal. Perhaps I should structure it differently (asserting that sSystemMetrics exists when off main thread)? It seems like the analysis won't understand the assert so I'd need to whitelist it anyway.
https://treeherder.mozilla.org/#/jobs?repo=try&revision=06eb380377e1e7542f6533f3bc5c2aba4823d7bc
Comment hidden (mozreview-request) |
Comment hidden (mozreview-request) |
Assignee | ||
Comment 15•8 years ago
|
||
Seems to be working now.
Final try at https://treeherder.mozilla.org/#/jobs?repo=try&revision=4e99c8e630e4485aa4318464d2304f1080af14d0
Comment hidden (mozreview-request) |
Assignee | ||
Updated•8 years ago
|
Attachment #8858178 -
Flags: review?(sphink)
Comment 17•8 years ago
|
||
Pushed by manishearth@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/1e269a211fe7
stylo: Initialize system metrics before traversing; r=bholley
Comment 18•8 years ago
|
||
bugherder |
Status: NEW → RESOLVED
Closed: 8 years ago
status-firefox55:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla55
You need to log in
before you can comment on or make changes to this bug.
Description
•