323978 - "ASSERTION: XPConnect is being called on a scope without a 'Components' property!"

Status: RESOLVED DUPLICATE of bug 400349

(Core :: XPConnect, defect, P1)

Comment 1

[Jesse Ruderman]

Attachment: reduced testcase -- triggers assertion, sometimes causes crash later

###!!! ASSERTION: XPConnect is being called on a scope without a 'Components' property!

This is pretty much always bad. It usually means that native code is
making a callback to an interface implemented in JavaScript, but the
document where the JS object was created has already been cleared and the
global properties of that document's window are *gone*. Generally this
indicates a problem that should be addressed in the design and use of the
callback code.

: 'Error', file mozilla/js/src/xpconnect/src/xpcwrappednativescope.cpp, line 589

Comment 2

[Jesse Ruderman]

I think this is a security hole because in one of the crash stacks, |this| was 0xdddddddd.

Comment 4

[Martijn Wargers (dead)]

I think the assertion mentioned in comment 3 could be bug 317497, which depends on bug 317240.

Comment 5

[Jesse Ruderman]

Attachment: stack trace for a crash

Comment 6

[timeless]

is this related to bug 321299?

Comment 7

[Jesse Ruderman]

mrbkap, will you be able to fix this in the near future?  I remember you saying that fixing this would make some leak bugs (such as bug 241518) worse; is that still an issue on the trunk now that bug 241518 is fixed?

Comment 9

[Darin Fisher]

-> mrbkap

Comment 10

[Daniel Veditz [:dveditz]]

Blocking 1.8.0.3 in hopes of a fix

Comment 11

[Blake Kaplan (:mrbkap) (inactive)]

I have a potential plan to fix the crash.

Comment 12

[Blake Kaplan (:mrbkap) (inactive)]

Update: this turned out to be much more complicated to debug than I originally though. I'm still trying to find the cause of the crash.

Comment 14

[Johnny Stenback (:jst)]

The crash seen in this bug is fixed by the patch attached to bug 321299 (includes mrbkap's above patch). Let's leave this bug open to track the assertion issue.

Comment 15

[Blake Kaplan (:mrbkap) (inactive)]

This bug shouldn't block the branches anymore, bug 321299 took care of the crash and this is now about the assertion.

Comment 16

[Jesse Ruderman]

Is this still [sg:critical]?

Comment 17

[Daniel Veditz [:dveditz]]

Removing "and crash when touching things in removed iframes" end of the summary per comment 14 -- does the summary still describe the right assertion?

Is this still a security problem, or does it remain private because of the testcase demonstrates 321299 in unfixed builds?

Comment 19

[Jesse Ruderman]

See also bug 335896, "GC destroys live frame / assertion 'Unexpected current doc in root content' / crash [@ nsContentIterator::NextNode]".  That bug involves netsted iframes.  I don't know how related it is to this bug.

Comment 20

[Daniel Veditz [:dveditz]]

minusing for 1.8.0 branch per comment 15

Comment 21

[Jesse Ruderman]

Attachment: slightly better reduced testcase

Made variables local and changed "0" to "false" in addEventListener call to make it clearer what the testcase is doing.

Comment 22

[Jesse Ruderman]

Attachment: reduced testcase, version 3

As suggested by timeless, remove the load event listener when it fires, so it's clear that it's only triggered once.

Comment 23

[Jesse Ruderman]

The assertion still fires on trunk with the most recent testcase.

Comment 24

[Jesse Ruderman]

I'm going to file a new bug, copy the relevant attachments and comments there, and mark this one as a dup.

(The alternative would be to use Bugzilla's new "private comments" feature, but hiding comment 0 and the comment with the patch would make the bug confusing.)