Bug 984033 - Large OOM in nsStreamLoader::WriteSegmentFun. r=honza
authorMakoto Kato <m_kato@ga2.so-net.ne.jp>
Thu, 17 Jul 2014 17:37:33 +0900
changeset 215378 f5d1735bbe5c55682f8cb2c586fdea52d0ec18e8
parent 215377 01f973e7aa611c935fcb72a40361f4217866223d
child 215379 cac86ecd534ec26c584671ad7ab179ec45348b51
push id3857
push userraliiev@mozilla.com
push dateTue, 02 Sep 2014 16:39:23 +0000
treeherdermozilla-beta@5638b907b505 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewershonza
bugs984033
milestone33.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 984033 - Large OOM in nsStreamLoader::WriteSegmentFun. r=honza
content/base/src/nsScriptLoader.cpp
gfx/thebes/gfxUserFontSet.cpp
netwerk/base/public/nsIStreamLoader.idl
netwerk/base/src/nsStreamLoader.cpp
security/manager/ssl/src/nsNSSCallbacks.cpp
--- a/content/base/src/nsScriptLoader.cpp
+++ b/content/base/src/nsScriptLoader.cpp
@@ -1412,17 +1412,17 @@ nsScriptLoader::OnStreamComplete(nsIStre
       UnblockParser(request);
       FireScriptAvailable(rv, request);
       ContinueParserAsync(request);
     } else {
       mPreloads.RemoveElement(request, PreloadRequestComparator());
     }
     rv = NS_OK;
   } else {
-    NS_Free(const_cast<uint8_t *>(aString));
+    moz_free(const_cast<uint8_t *>(aString));
     rv = NS_SUCCESS_ADOPTED_DATA;
   }
 
   // Process our request and/or any pending ones
   ProcessPendingRequests();
 
   return rv;
 }
--- a/gfx/thebes/gfxUserFontSet.cpp
+++ b/gfx/thebes/gfxUserFontSet.cpp
@@ -731,17 +731,17 @@ gfxUserFontSet::OnLoadComplete(gfxMixedF
     } else {
         // download failed
         LogMessage(aFamily, aProxy,
                    "download failed", nsIScriptError::errorFlag,
                    aDownloadStatus);
     }
 
     if (aFontData) {
-        NS_Free((void*)aFontData);
+        moz_free((void*)aFontData);
     }
 
     // error occurred, load next src
     (void)aProxy->LoadNext(aFamily, mLocalRulesUsed);
 
     // We ignore the status returned by LoadNext();
     // even if loading failed, we need to bump the font-set generation
     // and return true in order to trigger reflow, so that fallback
--- a/netwerk/base/public/nsIStreamLoader.idl
+++ b/netwerk/base/public/nsIStreamLoader.idl
@@ -22,18 +22,18 @@ interface nsIStreamLoaderObserver : nsIS
      *
      * This method will always be called asynchronously by the
      * nsIStreamLoader involved, on the thread that called the
      * loader's init() method.
      *
      * If the observer wants to take over responsibility for the
      * data buffer (result), it returns NS_SUCCESS_ADOPTED_DATA
      * in place of NS_OK as its success code. The loader will then
-     * "forget" about the data and not NS_Free() it after
-     * onStreamComplete() returns; observer must call NS_Free()
+     * "forget" about the data and not moz_free() it after
+     * onStreamComplete() returns; observer must call moz_free()
      * when the data is no longer required.
      */
     void onStreamComplete(in nsIStreamLoader loader,
                           in nsISupports ctxt,
                           in nsresult status,
                           in unsigned long resultLength,
                           [const,array,size_is(resultLength)] in octet result);
 };
--- a/netwerk/base/src/nsStreamLoader.cpp
+++ b/netwerk/base/src/nsStreamLoader.cpp
@@ -123,18 +123,18 @@ nsStreamLoader::WriteSegmentFun(nsIInput
 {
   nsStreamLoader *self = (nsStreamLoader *) closure;
 
   if (count > UINT32_MAX - self->mLength) {
     return NS_ERROR_ILLEGAL_VALUE; // is there a better error to use here?
   }
 
   if (self->mLength + count > self->mAllocated) {
-    self->mData = static_cast<uint8_t*>(NS_Realloc(self->mData,
-                                                   self->mLength + count));
+    self->mData = static_cast<uint8_t*>(moz_realloc(self->mData,
+                                                    self->mLength + count));
     if (!self->mData) {
       self->ReleaseData();
       return NS_ERROR_OUT_OF_MEMORY;
     }
     self->mAllocated = self->mLength + count;
   }
 
   ::memcpy(self->mData + self->mLength, fromSegment, count);
@@ -153,14 +153,14 @@ nsStreamLoader::OnDataAvailable(nsIReque
   uint32_t countRead;
   return inStr->ReadSegments(WriteSegmentFun, this, count, &countRead);
 }
 
 void
 nsStreamLoader::ReleaseData()
 {
   if (mData) {
-    NS_Free(mData);
+    moz_free(mData);
     mData = nullptr;
   }
   mLength = 0;
   mAllocated = 0;
 }
--- a/security/manager/ssl/src/nsNSSCallbacks.cpp
+++ b/security/manager/ssl/src/nsNSSCallbacks.cpp
@@ -599,17 +599,17 @@ nsHTTPListener::nsHTTPListener()
 }
 
 nsHTTPListener::~nsHTTPListener()
 {
   if (mResponsibleForDoneSignal)
     send_done_signal();
 
   if (mResultData) {
-    NS_Free(const_cast<uint8_t *>(mResultData));
+    moz_free(const_cast<uint8_t *>(mResultData));
   }
 
   if (mLoader) {
     nsCOMPtr<nsIThread> mainThread(do_GetMainThread());
     NS_ProxyRelease(mainThread, mLoader);
   }
 }