Jonathan Watt [:jwatt] Assignee
	Description • 13 years ago

The fix for bug 639728 forgot that items are created lazily. Checking that the list length is going to change to zero is not enough. The last remaining reference to the object may be a single item at an arbitrary index, so really we have to check whether the list length is decreasing.

	Daniel Holbert [:dholbert]
	Comment 2 • 13 years ago

Comment on attachment 544186 [details] [diff] [review]
patch

Do you have a testcase for this?  (not that we'd want to check it in yet)

We probably should take this on aurora & beta, too.

	Daniel Veditz [:dveditz]
	Comment 3 • 13 years ago

guessing sg:critical since the other one was and you marked this as a security bug? please correct if wrong.

	Daniel Holbert [:dholbert]
	Comment 4 • 13 years ago

Yes -- this is indeed [sg:critical].  (could trigger early deletion of the |this| pointer, followed by more method-calls on |this|, in the affected code.)

	Jonathan Watt [:jwatt] Assignee
	Comment 5 • 13 years ago

Pushed http://hg.mozilla.org/integration/mozilla-inbound/rev/a3053d8e4090

I don't have the cycles to make a regression testcase today, but I'll leave this bug open for that. The testcase only needs to land on trunk anyway.

	Jonathan Watt [:jwatt] Assignee
	Comment 6 • 13 years ago

Comment on attachment 544186 [details] [diff] [review]
patch

Yeah, I agree with dholbert this should land on beta and aurora. Pretty much no risk as mentioned in bug 639728 comment 20.

	LegNeato
	Comment 7 • 13 years ago

Comment on attachment 544186 [details] [diff] [review]
patch

Approved for releases/mozilla-aurora and releases/mozilla-beta

	Jonathan Watt [:jwatt] Assignee
	Comment 8 • 13 years ago

Pushed:

https://hg.mozilla.org/releases/mozilla-beta/rev/eb18cd57c25b
https://hg.mozilla.org/releases/mozilla-aurora/rev/85609541e35e

	u279076
	Comment 9 • 13 years ago

qa- as no QA fix verification needed