During the evolution of the fix for bug 352846 the macro JS_PUSH_TEMP_ROOT_OBJECT (that I added to have a convenient rooted pointer for JSObject*) ended up with a broken assignment to -3 of the counter. Fortunately it is used only at one place in jsarray.c where GC hazard is not possible due to fragile properties of the current code that ensure rooting of object. Moreover, the GC scanning code in jsgc.c when interpreting the counter as array length uses pointer arithmentic and < as a compare operation so that -3 would not allow to access junk memory. So the fix can wait FF 2.0.1.

Another oversight: I forgot to mark the bug as security-restricted.

Comment on attachment 240817 [details] [diff] [review] Fix v1. >+ * Alternatively, if a single pointer to rooted JSObject * is required, use >+ * JS_PUSH_TEMP_ROOT_OBJECT(cx, NULL, &tvr). Then &tvr.u.object gives the >+ * necessary pointer. Comment should say something like "... gives the necessary pointer, which puns tvr.u.value safely because object tag bits are all zeroes." /be

Patch to commit with updated comments.

Patch to commit with really updated comments.

I committed the patch from comment 5 to the trunk: Checking in jscntxt.h; /cvsroot/mozilla/js/src/jscntxt.h,v <-- jscntxt.h new revision: 3.121; previous revision: 3.120 done

This can wait 1.8.1.1, see comments 0.

Comment 0 mentions this as a cleanup for bug 352846 which appears to apply to the 1.8.0 branch, but then marks this as a blocker for bug 354982 (Iterator cleanup) which does not. Nominating for 1.8.0.9 just to be on the safe side.

Comment on attachment 240838 [details] [diff] [review] Fix 1b for real This is must-to-fix regression from bug 355029.

Comment on attachment 240838 [details] [diff] [review] Fix 1b for real I will include the regression fix into the patch for the bug itself.

Fixed on 1.8.1 as a part of the patch for the branch from bug 352846.

The fix committed to 1.8.0 branch from bug 354982 already had the changes to address this bug as well.

verified fixed 1.8.0.9, 1.8.1.1, 1.9 by code inspection: all branches contain (tvr)->count = -1; in JS_PUSH_TEMP_ROOT_OBJECT