Bug 984033 - Large OOM in nsStreamLoader::WriteSegmentFun. r=honza, a=lmandel, ba=comment-only-change
authorMakoto Kato <m_kato@ga2.so-net.ne.jp>
Thu, 17 Jul 2014 17:37:33 +0900
changeset 208175 ecfc5bee1685
parent 208174 a8dd4b54e15b
child 208176 bbfebb4ec504
push id3753
push userryanvm@gmail.com
push date2014-07-28 14:29 +0000
treeherdermozilla-beta@ecfc5bee1685 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewershonza, lmandel
bugs984033
milestone32.0
Bug 984033 - Large OOM in nsStreamLoader::WriteSegmentFun. r=honza, a=lmandel, ba=comment-only-change
content/base/src/nsScriptLoader.cpp
gfx/thebes/gfxUserFontSet.cpp
netwerk/base/public/nsIStreamLoader.idl
netwerk/base/src/nsStreamLoader.cpp
security/manager/ssl/src/nsNSSCallbacks.cpp
--- a/content/base/src/nsScriptLoader.cpp
+++ b/content/base/src/nsScriptLoader.cpp
@@ -1420,17 +1420,17 @@ nsScriptLoader::OnStreamComplete(nsIStre
       UnblockParser(request);
       FireScriptAvailable(rv, request);
       ContinueParserAsync(request);
     } else {
       mPreloads.RemoveElement(request, PreloadRequestComparator());
     }
     rv = NS_OK;
   } else {
-    NS_Free(const_cast<uint8_t *>(aString));
+    moz_free(const_cast<uint8_t *>(aString));
     rv = NS_SUCCESS_ADOPTED_DATA;
   }
 
   // Process our request and/or any pending ones
   ProcessPendingRequests();
 
   return rv;
 }
--- a/gfx/thebes/gfxUserFontSet.cpp
+++ b/gfx/thebes/gfxUserFontSet.cpp
@@ -499,17 +499,17 @@ gfxUserFontSet::OnLoadComplete(gfxMixedF
     } else {
         // download failed
         LogMessage(aFamily, aProxy,
                    "download failed", nsIScriptError::errorFlag,
                    aDownloadStatus);
     }
 
     if (aFontData) {
-        NS_Free((void*)aFontData);
+        moz_free((void*)aFontData);
     }
 
     // error occurred, load next src
     (void)LoadNext(aFamily, aProxy);
 
     // We ignore the status returned by LoadNext();
     // even if loading failed, we need to bump the font-set generation
     // and return true in order to trigger reflow, so that fallback
--- a/netwerk/base/public/nsIStreamLoader.idl
+++ b/netwerk/base/public/nsIStreamLoader.idl
@@ -22,18 +22,18 @@ interface nsIStreamLoaderObserver : nsIS
      *
      * This method will always be called asynchronously by the
      * nsIStreamLoader involved, on the thread that called the
      * loader's init() method.
      *
      * If the observer wants to take over responsibility for the
      * data buffer (result), it returns NS_SUCCESS_ADOPTED_DATA
      * in place of NS_OK as its success code. The loader will then
-     * "forget" about the data and not NS_Free() it after
-     * onStreamComplete() returns; observer must call NS_Free()
+     * "forget" about the data and not moz_free() it after
+     * onStreamComplete() returns; observer must call moz_free()
      * when the data is no longer required.
      */
     void onStreamComplete(in nsIStreamLoader loader,
                           in nsISupports ctxt,
                           in nsresult status,
                           in unsigned long resultLength,
                           [const,array,size_is(resultLength)] in octet result);
 };
--- a/netwerk/base/src/nsStreamLoader.cpp
+++ b/netwerk/base/src/nsStreamLoader.cpp
@@ -123,18 +123,18 @@ nsStreamLoader::WriteSegmentFun(nsIInput
 {
   nsStreamLoader *self = (nsStreamLoader *) closure;
 
   if (count > UINT32_MAX - self->mLength) {
     return NS_ERROR_ILLEGAL_VALUE; // is there a better error to use here?
   }
 
   if (self->mLength + count > self->mAllocated) {
-    self->mData = static_cast<uint8_t*>(NS_Realloc(self->mData,
-                                                   self->mLength + count));
+    self->mData = static_cast<uint8_t*>(moz_realloc(self->mData,
+                                                    self->mLength + count));
     if (!self->mData) {
       self->ReleaseData();
       return NS_ERROR_OUT_OF_MEMORY;
     }
     self->mAllocated = self->mLength + count;
   }
 
   ::memcpy(self->mData + self->mLength, fromSegment, count);
@@ -153,14 +153,14 @@ nsStreamLoader::OnDataAvailable(nsIReque
   uint32_t countRead;
   return inStr->ReadSegments(WriteSegmentFun, this, count, &countRead);
 }
 
 void
 nsStreamLoader::ReleaseData()
 {
   if (mData) {
-    NS_Free(mData);
+    moz_free(mData);
     mData = nullptr;
   }
   mLength = 0;
   mAllocated = 0;
 }
--- a/security/manager/ssl/src/nsNSSCallbacks.cpp
+++ b/security/manager/ssl/src/nsNSSCallbacks.cpp
@@ -609,17 +609,17 @@ nsHTTPListener::nsHTTPListener()
 }
 
 nsHTTPListener::~nsHTTPListener()
 {
   if (mResponsibleForDoneSignal)
     send_done_signal();
 
   if (mResultData) {
-    NS_Free(const_cast<uint8_t *>(mResultData));
+    moz_free(const_cast<uint8_t *>(mResultData));
   }
 
   if (mLoader) {
     nsCOMPtr<nsIThread> mainThread(do_GetMainThread());
     NS_ProxyRelease(mainThread, mLoader);
   }
 }