615260 - Assertion: compartment mismatched with simple XUL overlay

Status: RESOLVED DUPLICATE of bug 606058

(Core :: XPConnect, defect)

Description

[Benjamin Smedberg]

I wrote an extension with a very simple XUL overlay which is causing fatal (JS) asserts in debug builds:

stack:
#2  0x00007ffff68c10f7 in js::CompartmentChecker::fail (c1=0x7fffe81b5000, c2=
    0x7fffe2850800) at ../../../src/js/src/jscntxtinlines.h:541
#3  0x00007ffff68c1165 in js::CompartmentChecker::check (this=0x7fffffffc9d0, 
    c=0x7fffe2850800) at ../../../src/js/src/jscntxtinlines.h:549
#4  0x00007ffff68c1377 in js::CompartmentChecker::check (this=0x7fffffffc9d0, 
    script=0x7fffe5c15980) at ../../../src/js/src/jscntxtinlines.h:595
#5  0x00007ffff68c5847 in js::assertSameCompartment<JSObject*, JSScript*> (cx=
    0x7fffe488f400, t1=0x7fffe5d37d80, t2=0x7fffe5c15980)
    at ../../../src/js/src/jscntxtinlines.h:634
#6  0x00007ffff68b8524 in JS_ExecuteScript (cx=0x7fffe488f400, obj=
    0x7fffe5d37d80, script=0x7fffe5c15980, rval=0x7fffffffcab0)
    at ../../../src/js/src/jsapi.cpp:4834
#7  0x00007ffff591aab7 in nsJSContext::ExecuteScript (this=0x7fffe486bbe0, 
    aScriptObject=0x7fffe2634120, aScopeObject=0x7fffe5d37d80, aRetValue=0x0, 
    aIsUndefined=0x0) at ../../../src/dom/base/nsJSEnvironment.cpp:1899
#8  0x00007ffff58ee537 in nsXULDocument::ExecuteScript (this=0x7fffe47b8800, 
    aContext=0x7fffe486bbe0, aScriptObject=0x7fffe2634120)
    at ../../../../../src/content/xul/document/src/nsXULDocument.cpp:3622
#9  0x00007ffff58ee773 in nsXULDocument::ExecuteScript (this=0x7fffe47b8800, 
    aScript=0x7fffe472ac80)
    at ../../../../../src/content/xul/document/src/nsXULDocument.cpp:3645
#10 0x00007ffff58ec183 in nsXULDocument::ResumeWalk (this=0x7fffe47b8800)
    at ../../../../../src/content/xul/document/src/nsXULDocument.cpp:2995
#11 0x00007ffff58e4403 in nsXULDocument::OnPrototypeLoadDone (this=
    0x7fffe47b8800, aResumeWalk=1)
    at ../../../../../src/content/xul/document/src/nsXULDocument.cpp:647
#12 0x00007ffff58e4342 in nsXULDocument::EndLoad (this=0x7fffe47b8800)
    at ../../../../../src/content/xul/document/src/nsXULDocument.cpp:630
#13 0x00007ffff58dd8dc in XULContentSinkImpl::DidBuildModel (this=
    0x7fffe2bf2c80, aTerminated=0)
    at ../../../../../src/content/xul/document/src/nsXULContentSink.cpp:277
#14 0x00007ffff51cb63c in nsParser::DidBuildModel (this=0x7fffe29de380, 
    anErrorCode=0) at ../../../../src/parser/htmlparser/src/nsParser.cpp:1588
#15 0x00007ffff51cd518 in nsParser::ResumeParse (this=0x7fffe29de380, 
    allowIteration=1, aIsFinalChunk=1, aCanInterrupt=1)
    at ../../../../src/parser/htmlparser/src/nsParser.cpp:2367
#16 0x00007ffff51cf42c in nsParser::OnStopRequest (this=0x7fffe29de380, 
---Type <return> to continue, or q <return> to quit---
    request=0x7fffe39ded60, aContext=0x0, status=0)
    at ../../../../src/parser/htmlparser/src/nsParser.cpp:3000
#17 0x00007ffff518eb0a in nsJARChannel::OnStopRequest (this=0x7fffe39ded60, 
    req=0x7fffe2bf2d00, ctx=0x0, status=0)
    at ../../../src/modules/libjar/nsJARChannel.cpp:906
#18 0x00007ffff500d4a0 in nsInputStreamPump::OnStateStop (this=0x7fffe2bf2d00)
    at ../../../../src/netwerk/base/src/nsInputStreamPump.cpp:578
#19 0x00007ffff500cd3a in nsInputStreamPump::OnInputStreamReady (this=
    0x7fffe2bf2d00, stream=0x7fffe2842588)
    at ../../../../src/netwerk/base/src/nsInputStreamPump.cpp:403
#20 0x00007ffff66cce09 in nsInputStreamReadyEvent::Run (this=0x7fffe4860040)
    at ../../../src/xpcom/io/nsStreamUtils.cpp:112
#21 0x00007ffff66f8158 in nsThread::ProcessNextEvent (this=0x7fffec103cc0, 
    mayWait=0, result=0x7fffffffd19c)
    at ../../../src/xpcom/threads/nsThread.cpp:626
#22 0x00007ffff66820b0 in NS_ProcessNextEvent_P (thread=0x7fffec103cc0, 
    mayWait=0) at nsThreadUtils.cpp:250
#23 0x00007ffff64c8236 in mozilla::ipc::MessagePump::Run (this=0x7fffec10f4c0, 
    aDelegate=0x7fffec1261c0) at ../../../src/ipc/glue/MessagePump.cpp:110
#24 0x00007ffff6761ebb in MessageLoop::RunInternal (this=0x7fffec1261c0)
    at ../../../src/ipc/chromium/src/base/message_loop.cc:219
#25 0x00007ffff6761e40 in MessageLoop::RunHandler (this=0x7fffec1261c0)
    at ../../../src/ipc/chromium/src/base/message_loop.cc:202
#26 0x00007ffff6761dd1 in MessageLoop::Run (this=0x7fffec1261c0)
    at ../../../src/ipc/chromium/src/base/message_loop.cc:176
#27 0x00007ffff63625ef in nsBaseAppShell::Run (this=0x7fffe8195400)
    at ../../../../src/widget/src/xpwidgets/nsBaseAppShell.cpp:181
#28 0x00007ffff60a8ab9 in nsAppStartup::Run (this=0x7fffe81a9ce0)
    at ../../../../../src/toolkit/components/startup/src/nsAppStartup.cpp:191
#29 0x00007ffff4fb89ba in XRE_main (argc=5, argv=0x7fffffffddf8, aAppData=
    0x7ffff2e27080) at ../../../src/toolkit/xre/nsAppRunner.cpp:3691
#30 0x0000000000401cff in main (argc=5, argv=0x7fffffffddf8)
    at ../../../src/browser/app/nsBrowserApp.cpp:158

I'll attach the extension XPI, I'm using in a sec, but I suspect that the problem may be caused because I'm loading the overlay from a file: URI instead of a chrome: URI, and it has a <script>.

Comment 1

[Benjamin Smedberg]

Attachment: Extension that causes the assert on startup

The purpose of this extension is to crash a jetpack process to collect a crash report, but that's unimportant to the issue here.

Comment 2

[Andreas Gal :gal]

Reproduced. Awesome test case bsmedberg. Sorry for not following up on this sooner.