Closed Bug 1098145 Opened 5 years ago Closed 5 years ago

[BrowserAPI] iframe.download crash in Assertion failure: compartment_ (Caller needs to enter a compartment first)

Categories

(Core :: DOM: Core & HTML, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla36

People

(Reporter: kanru, Assigned: kanru)

References

(Depends on 1 open bug)

Details

Attachments

(1 file, 1 obsolete file)

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff3d567e4 in js::NewObjectWithClassProtoCommon(js::ExclusiveContext*, js::Class const*, JSObject*, JSObject*, js::gc::AllocKind, js::NewObjectKind) ()
   from /home/kanru/mozilla/B2G/gaia/b2g/libxul.so
#0  0x00007ffff3d567e4 in js::NewObjectWithClassProtoCommon(js::ExclusiveContext*, js::Class const*, JSObject*, JSObject*, js::gc::AllocKind, js::NewObjectKind) () from /home/kanru/mozilla/B2G/gaia/b2g/libxul.so
#1  0x00007ffff2afa7b8 in mozilla::dom::BrowserElementDownloadOptions::ToObjectInternal(JSContext*, JS::MutableHandle<JS::Value>) const ()
   from /home/kanru/mozilla/B2G/gaia/b2g/libxul.so
#2  0x00007ffff2f602f9 in mozilla::nsBrowserElement::Download(nsAString_internal const&, mozilla::dom::BrowserElementDownloadOptions const&, mozilla::ErrorResult&) () from /home/kanru/mozilla/B2G/gaia/b2g/libxul.so
#3  0x00007ffff2c32cb9 in mozilla::dom::HTMLIFrameElementBinding::download(JSContext*, JS::Handle<JSObject*>, mozilla::dom::HTMLIFrameElement*, JSJitMethodCallArgs const&) () from /home/kanru/mozilla/B2G/gaia/b2g/libxul.so
#4  0x00007ffff2e6c2ee in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) () from /home/kanru/mozilla/B2G/gaia/b2g/libxul.so
Attachment #8522104 - Flags: review?(bugs)
You should pass the JSObject to init()
Attachment #8522104 - Attachment is obsolete: true
Attachment #8522104 - Flags: review?(bugs)
Attachment #8522142 - Flags: review?(bugs)
Attachment #8522142 - Flags: review?(bugs) → review+
Depends on: 1098373
https://hg.mozilla.org/mozilla-central/rev/37970af40c4a
Assignee: nobody → kanru
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla36
Backed out in https://hg.mozilla.org/mozilla-central/rev/1f1fba261deb so I could cleanly back out bug 1044736.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
https://hg.mozilla.org/mozilla-central/rev/389b2964076b
Status: REOPENED → RESOLVED
Closed: 5 years ago5 years ago
Resolution: --- → FIXED
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.