1018085 - "ASSERTION: Inner window supports nsWrapperCache, fix WrapObject!"

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

Attachment: j.html

1. Create a profile
       with the prefs:
           user_pref("dom.min_background_timeout_value", 4);
           user_pref("dom.disable_open_during_load", false);
       and the extension:
           https://www.squarefree.com/extensions/domFuzzLite3.xpi

2. Run with the testcase filename on the command line
       (You might have to repeat step 2 a few times.)

###!!! ASSERTION: Inner window supports nsWrapperCache, fix WrapObject!: 'IsOuterWindow()', file dom/base/nsGlobalWindow.h, line 354
   (This assertion was added in bug 693301.)

###!!! ASSERTION: EnsureInnerWindow called on inner window: 'IsOuterWindow()', file dom/base/nsPIDOMWindow.h, line 331

Comment 1

[Jesse Ruderman]

Attachment: stack for the first assertion

Comment 2

[Peter Van der Beken [:peterv]]

We're firing the DOMContentLoaded event for "missing-1" (actually for the error page for that) but we've already collected the inner window for it.

Comment 3

[Peter Van der Beken [:peterv]]

The exact same thing happens with XPConnect reflectors for Window, but SetParentToWindow returns an error if the nsGlobalWindow doesn't have a wrapper anymore.

Comment 4

[Peter Van der Beken [:peterv]]

Attachment: v1

Comment 5

[Andrew McCreight [:mccr8]]

Please adjust the rating as appropriate.  I assume this is a regression from Window WebIDL.

Comment 6

[Peter Van der Beken [:peterv]]

Attachment: v1

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8435783 [details] [diff] [review]
v1

r=me

Comment 8

[Peter Van der Beken [:peterv]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4b7010671a27

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/4b7010671a27

Comment 10

[Peter Van der Beken [:peterv]]

Comment on attachment 8435783 [details] [diff] [review]
v1

Ugh, this missed the branching.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): bug 789261
User impact if declined: probably crashes/security issues
Testing completed (on m-c, etc.): landed on m-c
Risk to taking this patch (and alternatives if risky): low-risk, just makes us deal with a situation that we thought couldn't happen
String or IDL/UUID changes made by this patch: none

Comment 11

[Lawrence Mandel [:lmandel] (use needinfo)]

Comment on attachment 8435783 [details] [diff] [review]
v1

Aurora approval granted.

Comment 12

[Peter Van der Beken [:peterv]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/9a12cabec2fe

Comment 13

[Matt Wobensmith [:mwobensmith][:matt:]]

Confirmed assert/crash on Fx32, 2014-05-30.
Verified fixed on Fx32, 2014-07-14.
Verified fixed on Fx33, 2014-07-07.