1259044 - The mystery of the disappearing location property

Status: RESOLVED DUPLICATE of bug 1251361

(Core :: DOM: Core & HTML, defect)

Description

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

#1  0x0000000102659c4a in JS::Heap<JS::Value>::operator= (this=0x121a893d8, p=@0x7fff5fbfbeb0) at RootingAPI.h:242
#2  0x0000000105652197 in mozilla::dom::DOMProxyHandler::GetAndClearExpandoObject (obj=0x159461280) at DOMJSProxyHandler.cpp:93
#3  0x00000001045e662d in nsWrapperCache::ReleaseWrapper (this=0x121a89008, aScriptObjectHolder=0x121a89000) at nsWrapperCache.cpp:58
#4  0x000000010449f045 in nsDocument::Destroy (this=0x121a89000) at nsDocument.cpp:8948
#5  0x0000000106d5fbcb in nsDocumentViewer::Destroy (this=0x121b5dbc0) at nsDocumentViewer.cpp:1642
#6  0x0000000106d6943b in nsDocumentViewer::Show (this=0x121e64830) at nsDocumentViewer.cpp:1957
#7  0x0000000106d9bd55 in nsPresContext::EnsureVisible (this=0x121428800) at nsPresContext.cpp:2250
#8  0x0000000106dad0ff in PresShell::UnsuppressAndInvalidate (this=0x12257b800) at nsPresShell.cpp:3758
#9  0x0000000106da44da in PresShell::UnsuppressPainting (this=0x12257b800) at nsPresShell.cpp:3801

<bz> I think there's our buggy stack
<bz> We clear out the expando object
<bz> which is where the location prop lives
<bz> The first one may be sticking around because it got bfcached or something

Test case coming up

Comment 1

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Attachment: Helper 1

Comment 2

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Attachment: Helper 2

Comment 3

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Attachment: Test

Comment 4

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Attachment: Test

Comment 5

[Andrew Overholt [:overholt]]

Is this fixed now?

Comment 6

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Seems like it is.