Closed
Bug 758846
Opened 12 years ago
Closed 12 years ago
"Assertion failure: p.found()" with gczeal and chrome-content interaction
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla16
People
(Reporter: jruderman, Assigned: billm)
Details
(Keywords: assertion, testcase, Whiteboard: [js:p1:fx16])
Attachments
(3 files)
1. Install https://www.squarefree.com/extensions/domFuzzLite3.xpi (version 2012-05-25 or higher) 2. Load the testcase. Result: Assertion failure: p.found(), at js/src/jsproxy.cpp:1474
Reporter | ||
Comment 1•12 years ago
|
||
Assignee | ||
Updated•12 years ago
|
Assignee: general → wmccloskey
Comment 2•12 years ago
|
||
fwiw, I hit this on nightly winxp once at http://www.podnapisi.net/en/ppodnapisi/podnapis/i/1691083/showRelease/1/showYear/0/shortFormat/0/translateTitle/1 but it is not reproducible. pseudo stack: proxy_TraceObject js::GCMarker::processMarkStackTop(js::SliceBudget&) js::GCMarker::drainMarkStack(js::SliceBudget&) NonIncrementalMark GCCycle
Assignee | ||
Comment 3•12 years ago
|
||
The assertion is saying that every cross-compartment wrapper should be registered in the wrapper map. This invariant is temporarily violated when creating the wrapper. We can GC during the period when it's violated. I don't think this is a problem. The object being wrapped should always be on the stack during the violation, so any GC at that time is guaranteed to scan the wrapped object. That's all we really care about, so I think we're safe. This patch just keeps a count of how many invocations of JSCompartment::wrap are on the stack. If this number is non-zero, then we don't do the assertion.
Attachment #633277 -
Flags: review?(luke)
Updated•12 years ago
|
Attachment #633277 -
Flags: review?(luke) → review+
Updated•12 years ago
|
Whiteboard: [js:p1:fx16]
Assignee | ||
Comment 4•12 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/57054d8b1582 Also, this is not sensitive.
Group: core-security
Target Milestone: --- → mozilla16
Comment 5•12 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/57054d8b1582
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•