1007458 - Crash passing a cross-origin window object as an "argument" to showModalDialog

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

Attachment: testcase (click the buttons in order, without closing anything)

###!!! ASSERTION: bad param: 'value', file /Users/jruderman/trees/mozilla-central/js/xpconnect/src/nsXPConnect.cpp, line 1009

Followed by a crash [@ XPCVariant::VariantDataToJS]

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Actually check for errors when converting a Value to a variant in showModalDialog

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 8419475 [details] [diff] [review]
Actually check for errors when converting a Value to a variant in showModalDialog

I guess this is fine. Edge case in an API we want to get rid of anyway.

Comment 4

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1c5877af35e1

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/1c5877af35e1

Comment 6

[Paul Silaghi, QA [:pauly]]

Repro in Nightly 2014-05-08-mozilla-central-debug.
Verified fixed Nightly 32.0a1 2014-05-27-mozilla-central-debug, Win 7 x64.