Details
Details
- Reviewers
• perry jstutte - Commits
- rMOZILLACENTRAL3353f680e068: Bug 1626728 - Normalize shutdown. r=perry,jstutte, a=RyanVM
rMOZILLACENTRAL31422fcc61f2: Bug 1626728 - Normalize shutdown. r=perry,jstutte, a=RyanVM
rMOZILLACENTRAL73e370ab9539: Bug 1626728 - Normalize shutdown. r=perry,jstutte, a=RyanVM on a CLOSED TREE
rMOZILLACENTRAL6639deb89417: Bug 1626728 - Normalize shutdown. r=perry,jstutte, a=RyanVM
rMOZILLACENTRALa3dd5ee8c5f2: Bug 1626728 - Normalize shutdown. r=perry, a=RyanVM
rMOZILLACENTRAL70743aa8b7b6: Bug 1626728 - Normalize shutdown. r=perry, a=RyanVM
rMOZILLACENTRAL1036ae72b56e: Bug 1626728 - Normalize shutdown. r=perry, a=RyanVM
rMOZILLACENTRALb7170a7eaacb: Bug 1626728 - Normalize shutdown. r=perry, a=RyanVM - Bugzilla Bug ID
- 1626728
Diff Detail
Diff Detail
- Repository
- rMOZILLACENTRAL mozilla-central
- Lint
Lint Not Applicable - Unit
Tests Not Applicable
Event Timeline
Comment Actions
My understanding of what goes wrong is that
- StreamList has a raw pointer to a CacheStreamControlParent (mStreamControl)
- StreamList calling mStreamControl->CloseAll(); can indirectly re-enter a StreamList method for the same calling instance and delete its mStreamControl, which means it's deleting itself
- Before CloseAll returns and after the mStreamControl is deleted, it (mStreamControl) would call one of its own methods, which is a UAF
Removing StreamList's member pointer prevents the mStreamControl from indirectly deleting itself. Shutdown is just additional cleanup to delete (what used to be) mStreamControl