Closed Bug 827962 Opened 11 years ago Closed 11 years ago

Compartment mismatch in mozilla::dom::URLBinding::revokeObjectURL

Categories

(Core :: DOM: Core & HTML, defect)

defect
Not set
normal

Tracking

()

RESOLVED DUPLICATE of bug 821760
Tracking Status
firefox18 --- unaffected
firefox19 --- affected
firefox20 --- affected
firefox21 --- affected

People

(Reporter: mccr8, Unassigned)

References

Details

I see three crash stacks like this:

0 js::CompartmentChecker::fail 	js/src/jscntxtinlines.h:204
1 JS_GetGlobalForObject 	js/src/jsapi.cpp:2233
2 mozilla::dom::URLBinding::revokeObjectURL 	obj-firefox/dom/bindings/URLBinding.cpp:268
3 js::InvokeKernel 	js/src/jsinterp.cpp:389
4 js::Interpret 	js/src/jsinterp.cpp:2348
5 js::RunScript 	

I'm not sure exactly what is calling JS_GetGlobalForObject, as the line numbers don't seem to match what I have locally.

https://crash-stats.mozilla.com/report/index/896e519b-6b03-424b-be5a-156902130107
https://crash-stats.mozilla.com/report/index/7a896715-fdf0-452a-8682-a95362130102
https://crash-stats.mozilla.com/report/index/bdb83485-e593-44bb-9577-555762130102

URL was converted to the new DOM bindings in bug 792675, which is in 19. Speculatively marking 19 and later as affected.
The build ID for those three crashes is "20121214030827".

Bug 821760 landed on m-c on 2012-12-15.  So as far as I can tell, this is a duplicate of that bug.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
Group: core-security
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.