Bug 777304 - Don't use freed pointer after destructor of NS_ConvertUTF16toUTF8. r=bsmedberg
authorMakoto Kato <m_kato@ga2.so-net.ne.jp>
Fri, 27 Jul 2012 12:13:51 +0900
changeset 106159 5fe4c57fb73eac2b217fd2c18a0315cb975c8ca6
parent 106158 73d5c4461f12ca1670043445e03071993932794c
child 106160 399aff2fb74f9269ee72ac8cbd7d3913402244d8
child 106161 5e4adc2cfe2680f4852adb1be0e98680b14f30a7
push id1490
push userakeybl@mozilla.com
push dateMon, 08 Oct 2012 18:29:50 +0000
treeherdermozilla-beta@f335e7dacdc1 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbsmedberg
bugs777304
milestone17.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 777304 - Don't use freed pointer after destructor of NS_ConvertUTF16toUTF8. r=bsmedberg
content/media/webrtc/MediaEngineWebRTCVideo.cpp
dom/bluetooth/linux/BluetoothDBusService.cpp
widget/android/AndroidGraphicBuffer.cpp
--- a/content/media/webrtc/MediaEngineWebRTCVideo.cpp
+++ b/content/media/webrtc/MediaEngineWebRTCVideo.cpp
@@ -282,18 +282,18 @@ MediaEngineWebRTCVideoSource::Snapshot(P
   // Create a temporary file on the main thread and put the snapshot in it.
   // See Run() in MediaEngineWebRTCVideo.h (sets mSnapshotPath).
   NS_DispatchToMainThread(this, NS_DISPATCH_SYNC);
 
   if (!mSnapshotPath) {
     return NS_ERROR_FAILURE;
   }
 
-  const char* path = NS_ConvertUTF16toUTF8(*mSnapshotPath).get();
-  if (vieFile->GetCaptureDeviceSnapshot(mCapIndex, path) < 0) {
+  NS_ConvertUTF16toUTF8 path(*mSnapshotPath);
+  if (vieFile->GetCaptureDeviceSnapshot(mCapIndex, path.get()) < 0) {
     delete mSnapshotPath;
     mSnapshotPath = NULL;
     return NS_ERROR_FAILURE;
   }
 
   // Stop the camera.
   mViERender->StopRender(mCapIndex);
   mViERender->RemoveRenderer(mCapIndex);
--- a/dom/bluetooth/linux/BluetoothDBusService.cpp
+++ b/dom/bluetooth/linux/BluetoothDBusService.cpp
@@ -543,22 +543,22 @@ BluetoothDBusService::SendDiscoveryMessa
   if (!mConnection) {
     NS_WARNING("Bluetooth service not started yet!");
     return NS_ERROR_FAILURE;
   }
   NS_ASSERTION(NS_IsMainThread(), "Must be called from main thread!");
 
   nsRefPtr<BluetoothReplyRunnable> runnable = aRunnable;
 
-  const char* s = NS_ConvertUTF16toUTF8(aAdapterPath).get();
+  NS_ConvertUTF16toUTF8 s(aAdapterPath);
   if (!dbus_func_args_async(mConnection,
                             1000,
                             GetVoidCallback,
                             (void*)aRunnable,
-                            s,
+                            s.get(),
                             DBUS_ADAPTER_IFACE,
                             aMessageName,
                             DBUS_TYPE_INVALID)) {
     NS_WARNING("Could not start async function!");
     return NS_ERROR_FAILURE;
   }
   runnable.forget();
   return NS_OK;
--- a/widget/android/AndroidGraphicBuffer.cpp
+++ b/widget/android/AndroidGraphicBuffer.cpp
@@ -438,33 +438,33 @@ static const char* const sAllowedBoards[
 
 bool
 AndroidGraphicBuffer::IsBlacklisted()
 {
   nsAutoString board;
   if (!AndroidBridge::Bridge()->GetStaticStringField("android/os/Build", "BOARD", board))
     return true;
 
-  const char* boardUtf8 = NS_ConvertUTF16toUTF8(board).get();
+  NS_ConvertUTF16toUTF8 boardUtf8(board);
 
   if (Preferences::GetBool("direct-texture.force.enabled", false)) {
-    LOG("allowing board '%s' due to prefs override", boardUtf8);
+    LOG("allowing board '%s' due to prefs override", boardUtf8.get());
     return false;
   }
 
   if (Preferences::GetBool("direct-texture.force.disabled", false)) {
-    LOG("disallowing board '%s' due to prefs override", boardUtf8);
+    LOG("disallowing board '%s' due to prefs override", boardUtf8.get());
     return true;
   }
 
   // FIXME: (Bug 722605) use something better than a linear search
   for (int i = 0; sAllowedBoards[i]; i++) {
     if (board.Find(sAllowedBoards[i]) >= 0) {
-      LOG("allowing board '%s' based on '%s'\n", boardUtf8, sAllowedBoards[i]);
+      LOG("allowing board '%s' based on '%s'\n", boardUtf8.get(), sAllowedBoards[i]);
       return false;
     }
   }
 
-  LOG("disallowing board: %s\n", boardUtf8);
+  LOG("disallowing board: %s\n", boardUtf8.get());
   return true;
 }
 
 } /* mozilla */