1034682 - Assertion failure: !xpc::IsInContentXBLScope(boundScope)

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Peter Van der Beken [:peterv]]

I made a small change to textbox.xml, and hit this assertion while running dom/tests/mochitest/bugs/test_bug335976.xhtml.

Comment 1

[Peter Van der Beken [:peterv]]

Attachment: Small change to textbox.xml

Comment 2

[Peter Van der Beken [:peterv]]

Bobby, if you apply this patch and run dom/tests/mochitest/bugs/test_bug335976.xhtml you'll hit the assertion in nsXBLBinding::LookupMember. Is the assert wrong?

Comment 3

[Bobby Holley (:bholley)]

So, this is another case of xbl destructors not running at a meaningful time. We adopt a bound element from one document to the other, and then run the <destructor> off of a script blocker. By the time that runs, the element is already in the new document, so we actually compile and execute the destructor in the new scope, rather than the old one. It then ends up interacting with anonymous content that lives in the old scope, causing us to trip the assertion (which is generally asserting against Weird Things Happening).

I think the right thing to do is to turn off same-origin Xrays for XBL scopes. I'll attach a patch.

Comment 4

[Bobby Holley (:bholley)]

Attachment: Set wantXrays to false for content XBL scopes. v1

Comment 5

[Peter Van der Beken [:peterv]]

This seems to break a lot of tests (as an example, run content/base/test/test_bug166235.html).

Comment 6

[Bobby Holley (:bholley)]

https://tbpl.mozilla.org/?tree=Try&rev=fc01f6a442b9

Comment 7

[Bobby Holley (:bholley)]

Attachment: Part 1 - Remove nonsensical sandboxProto waiving in the wantXrays case. v1

This doesn't make sense. wantXrays means that the WrapperFactory machinery gives
us Xrays in the same-origin case. When it's false, we don't have Xrays to
same-origin objects to begin with, so the waive is useless. Its only observable
effect comes in the situation of privileged (i.e. nsEP) sandboxes with a
less-privileged sandboxPrototype. And I see no reason why these things should get
a waived prototype.

It looks like this was added in 2010 for the Web Console in bug 611401. None of
that is applicable anymore.

Comment 8

[Bobby Holley (:bholley)]

Attachment: Part 2 - Move remaining wacky wantXrays behavior to the JS entry point so that we don't have to worry about it when creating Sandboxes from C++. v1

Comment 9

[Bobby Holley (:bholley)]

Attachment: Part 3 - Set wantXrays to false for content XBL scopes. v2

Comment 10

[Bobby Holley (:bholley)]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/cc85d728482e
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/ee683f7998c1
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/91a2a519a725

Comment 11

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/cc85d728482e
https://hg.mozilla.org/mozilla-central/rev/ee683f7998c1
https://hg.mozilla.org/mozilla-central/rev/91a2a519a725

Comment 12

[[e-mail]]

Comment on attachment 8452621 [details] [diff] [review]
Part 3 - Set wantXrays to false for content XBL scopes. v2

>+          // Touch a non-existent property on our anonymous input field. This
>+          // serves as test coverage for bug 1034682.
>+          this.inputField.foo;
And also spams the console if you have warnings enabled...

Comment 13

[Bobby Holley (:bholley)]

See bug 1038278.