295200 - Crash calling createRange on a wrapped document

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[[e-mail]]

Steps to reproduce problem:
1. Open the JavaScript console
2. Evaluate (new XPCNativeWrapper(top.document)).createRange()

Expected result: [object Range]

Actual result: Crash in JS_GetClass jsapi.c:2040
JSVAL_TO_PRIVATE(GC_AWARE_GET_SLOT(cx, obj, JSSLOT_CLASS));

Additional information:
Evaluating (new XPCNativeWrapper(top.document)).toString()
displays [XPCNativeWrapper [object XULDocument]]
Evaluating "" + (new XPCNativeWrapper(top.document))
displays [object XULDocument]
Evaluating (new XPCNativeWrapper(top.document))
fails with an assertion at nsFrameLoader.cpp:170

Note: the code works in an extension with autowrapping enabled.

Comment 1

[Noa Groveman]

confirmed with Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2)
Gecko/20050523 Firefox/1.0+

Comment 2

[Boris Zbarsky [:bzbarsky]]

This looks a lot like the crash I'm seeing in bug 295101

Comment 3

[Boris Zbarsky [:bzbarsky]]

Fixed by patch in bug 295101.