1183907 - URL object in workers doesn't traverse its wrapper

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Olli Pettay [:smaug][[e-mail]]]

Load http://mozilla.pettay.fi/workerconsole/ and type the following to the upper textarea
var u = new URL("about:blank");
u.foo = u;

#0  0x00007fffee0a02f6 in nsWrapperCache::CheckCCWrapperTraversal(void*, nsScriptObjectTracer*) (this=0x7fffb9113e28, aScriptObjectHolder=0x7fffb9113e20, aTracer=0x7ffff51b6ae8 <mozilla::dom::workers::URL::_cycleCollectorGlobal>) at /home/smaug/mozilla/hg/push-m-i/dom/base/nsWrapperCache.cpp:125
#1  0x00007fffed488582 in nsWrapperCache::PreserveWrapper(void*, nsScriptObjectTracer*) (this=0x7fffb9113e28, aScriptObjectHolder=0x7fffb9113e20, aTracer=0x7ffff51b6ae8 <mozilla::dom::workers::URL::_cycleCollectorGlobal>) at /home/smaug/mozilla/hg/push-m-i/js/xpconnect/wrappers/../../../dom/base/nsWrapperCache.h:251
#2  0x00007fffed486d87 in nsWrapperCache::PreserveWrapper(nsISupports*) (this=0x7fffb9113e28, aScriptObjectHolder=0x7fffb9113e20)
    at /home/smaug/mozilla/hg/push-m-i/js/xpconnect/wrappers/../../../dom/base/nsWrapperCache.h:238
#3  0x00007fffeea94b63 in mozilla::dom::PreserveWrapperHelper<mozilla::dom::workers::URL, true>::PreserveWrapper(mozilla::dom::workers::URL*) (aObject=0x7fffb9113e20)
    at ../../dist/include/mozilla/dom/BindingUtils.h:2639
#4  0x00007fffeea94b35 in mozilla::dom::PreserveWrapper<mozilla::dom::workers::URL>(mozilla::dom::workers::URL*) (aObject=0x7fffb9113e20) at ../../dist/include/mozilla/dom/BindingUtils.h:2646
#5  0x00007fffee970035 in mozilla::dom::URLBinding_workers::_addProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>) (cx=0x7fffc3ccae40, obj=..., id=..., val=...)
    at ./URLBinding.cpp:2423
#6  0x00007ffff2169290 in js::CallJSAddPropertyOp(JSContext*, bool (*)(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>), JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>) (cx=0x7fffc3ccae40, op=0x7fffee96ffd0 <mozilla::dom::URLBinding_workers::_addProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::Handle<JS::Value>)>, obj=..., id=..., v=...)
    at /home/smaug/mozilla/hg/push-m-i/js/src/jscntxtinlines.h:330

I never remember why we have so different URL impl on workers.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Attachment: patch

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3ba60b819403

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/3ba60b819403

What's the severity of this? Does it affect other branches?

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Doesn't affect other branches. Regression from Bug 1177916.

Comment 5

[Ada [:adalucinet]]

Reproduced with Nightly asan build from 2015-07-14, under Ubuntu 12.04 64-bit: tab crash encountered with STR via comment 0.

No crash encountered with 42.0RC build 1 (Build ID: 20151026170526), across platforms [1].

[1] Ubuntu 12.04 64-bit, Windows 10 64-bit and Mac OS X 10.11