Who can spot the use-after-free bug in this code? hg.mozilla.org/mozilla-centr…
1
@nsIAnswers nothing's holding a ref to *result, so the NS_SetThreadName might release it?
2
@vvuk Close, but you got the wrong "thing that might release it".
1
@nsIAnswers @vvuk how is it wrong? Setting the name is async according to the docs (I hope it holds a ref until the naming is complete...)
1
@sdwilsh @vvuk @CodingExon *result is a member which is cleared on the other thread when the task runs and the nsThread dies.
3
Replying to @nsIAnswers
@nsIAnswers @sdwilsh @vvuk @CodingExon so does the patch leak because the code to release *aResult runs before it's assigned?

Apr 17, 2014 · 1:53 AM UTC