529269 - crash in [@ XPCWrapper::NativeToString]

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Axel Hecht [:Pike]]

I've hit a crash triggered by DOM inspector's javascript object view:

Open the options window in namoroka, then select the prefwindow element, javascript object. Expand boxObject, firstChild, element, parentNode.

Crash stacks in http://crash-stats.mozilla.com/report/index/bp-015fbe1f-6f97-48b2-9bc0-987b62091117, http://crash-stats.mozilla.com/report/index/560525a8-d9fb-4a7b-9a5e-5f5422091117

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

There's no guarantee that we have a native underlying our wrapper, so we shouldn't do anything special for toString.

Comment 2

[timeless]

0 	XUL 	XPCWrapper::NativeToString 	js/src/xpconnect/src/xpcprivate.h:2387
1 	XUL 	XPC_SOW_toString 	js/src/xpconnect/src/XPCSystemOnlyWrapper.cpp:696
2 	libmozjs.dylib 	js_Invoke 	js/src/jsinterp.cpp:1360
3 	libmozjs.dylib 	js_Interpret 	js/src/jsops.cpp:2240
4 	libmozjs.dylib 	js_Invoke 	js/src/jsinterp.cpp:1368

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 412845 [details] [diff] [review]
Proposed fix

Safe patch for the next dot release.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/2d69f02b1e5e

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 412845 [details] [diff] [review]
Proposed fix

This patch doesn't actually apply cleanly to the 1.9.2 branch.

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: For 1.9.2

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 418945 [details] [diff] [review]
For 1.9.2

Mostly code removal, aside from a comment.

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 418945 [details] [diff] [review]
For 1.9.2

Approved for 1.9.2.4, a=dveditz for release-drivers

Comment 9

[Reed Loden [:reed]]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/d73d65e32ff6