Assertion failure: !xpc::IsInContentXBLScope(boundScope)

RESOLVED FIXED in mozilla33

Status

()

defect
RESOLVED FIXED
5 years ago
a month ago

People

(Reporter: peterv, Assigned: bholley)

Tracking

Trunk
mozilla33
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(5 attachments)

(Reporter)

Description

5 years ago
I made a small change to textbox.xml, and hit this assertion while running dom/tests/mochitest/bugs/test_bug335976.xhtml.
(Reporter)

Comment 2

5 years ago
Bobby, if you apply this patch and run dom/tests/mochitest/bugs/test_bug335976.xhtml you'll hit the assertion in nsXBLBinding::LookupMember. Is the assert wrong?
Blocks: 787070
Flags: needinfo?(bobbyholley)
(Assignee)

Comment 3

5 years ago
So, this is another case of xbl destructors not running at a meaningful time. We adopt a bound element from one document to the other, and then run the <destructor> off of a script blocker. By the time that runs, the element is already in the new document, so we actually compile and execute the destructor in the new scope, rather than the old one. It then ends up interacting with anonymous content that lives in the old scope, causing us to trip the assertion (which is generally asserting against Weird Things Happening).

I think the right thing to do is to turn off same-origin Xrays for XBL scopes. I'll attach a patch.
Flags: needinfo?(bobbyholley)
(Reporter)

Comment 5

5 years ago
This seems to break a lot of tests (as an example, run content/base/test/test_bug166235.html).
(Assignee)

Updated

5 years ago
Attachment #8451776 - Flags: review?(wmccloskey)
(Assignee)

Comment 7

5 years ago
This doesn't make sense. wantXrays means that the WrapperFactory machinery gives
us Xrays in the same-origin case. When it's false, we don't have Xrays to
same-origin objects to begin with, so the waive is useless. Its only observable
effect comes in the situation of privileged (i.e. nsEP) sandboxes with a
less-privileged sandboxPrototype. And I see no reason why these things should get
a waived prototype.

It looks like this was added in 2010 for the Web Console in bug 611401. None of
that is applicable anymore.
Attachment #8452619 - Flags: review?(peterv)
Attachment #8452621 - Flags: review?(wmccloskey) → review+
(Reporter)

Updated

5 years ago
Attachment #8452619 - Flags: review?(peterv) → review+
(Reporter)

Updated

5 years ago
Attachment #8452620 - Flags: review?(peterv) → review+
(Reporter)

Updated

5 years ago
Assignee: nobody → bobbyholley
Depends on: 1038278
Comment on attachment 8452621 [details] [diff] [review]
Part 3 - Set wantXrays to false for content XBL scopes. v2

>+          // Touch a non-existent property on our anonymous input field. This
>+          // serves as test coverage for bug 1034682.
>+          this.inputField.foo;
And also spams the console if you have warnings enabled...
(Assignee)

Comment 13

5 years ago
See bug 1038278.
Component: DOM → DOM: Core & HTML
Product: Core → Core
You need to log in before you can comment on or make changes to this bug.