Closed
Bug 773370
Opened 12 years ago
Closed 12 years ago
Fix rooting in JSArray creation for mozTelephony
Categories
(Core :: DOM: Device Interfaces, defect)
Tracking
()
People
(Reporter: qdot, Assigned: qdot)
References
Details
Attachments
(1 file)
|
(deleted),
patch
|
bent.mozilla
:
review+
|
Details | Diff | Splinter Review |
There are functions in mozTelephony and mozBluetooth that convery nsTArrays to JSArrays. The internal machinery moves values to an internal nsTArray that's then tranformed as part of JS_NewArrayObject. There could be a GC sweep during this conversion that could cause some of the values to be swept before rooting.
|
||
Comment 1•12 years ago
|
||
Hm do we also need a write barrier now with IGC?
|
Assignee | |
Updated•12 years ago
|
Assignee: nobody → kyle
Blocks: b2g-bluetooth, b2g-ril
|
||
Comment 2•12 years ago
|
||
Kyle, Gregor: Does this need to block the release?
blocking-basecamp: --- → ?
|
|
Assignee | |
Updated•12 years ago
|
No longer blocks: b2g-bluetooth
|
|
Assignee | |
Updated•12 years ago
|
Summary: Fix rooting in JSArray creation for mozTelephony/mozBluetooth → Fix rooting in JSArray creation for mozTelephony
|
|
Assignee | |
Comment 3•12 years ago
|
||
Nope, this doesn't block release. It's already fixed in 761511 for bluetooth, too.
|
|
Assignee | |
Comment 4•12 years ago
|
||
Attachment #648098 -
Flags: review?(bent.mozilla)
|
||
Updated•12 years ago
|
Attachment #648098 -
Flags: review?(bent.mozilla) → review+
|
|
Assignee | |
Comment 5•12 years ago
|
||
Target Milestone: --- → mozilla17
|
||
Comment 6•12 years ago
|
||
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•