Closed
Bug 327597
Opened 19 years ago
Closed 19 years ago
nsIFoo.toString.apply(Components) crashes Firefox [@ GetWrappedNativeOfJSObject]
Categories
(Core :: XPConnect, defect, P1)
Core
XPConnect
Tracking
()
VERIFIED
FIXED
mozilla1.9alpha1
People
(Reporter: jruderman, Assigned: mrbkap)
References
Details
(5 keywords, Whiteboard: [patch])
Crash Data
Attachments
(3 files)
|
78 bytes,
text/html
|
Details | |
|
5.76 KB,
text/plain
|
Details | |
|
1.85 KB,
patch
|
jst
:
review+
bzbarsky
:
superreview+
dveditz
:
approval-branch-1.8.1+
dveditz
:
approval1.8.0.5+
|
Details | Diff | Splinter Review |
|
Reporter | |
Comment 1•19 years ago
|
||
|
|
Reporter | |
Comment 2•19 years ago
|
||
windows trunk crashes too.
regression between 2005-09-01-07-trunk and 2005-09-02-07-trunk.
probably be bug 304423.
|
Assignee | |
Comment 4•19 years ago
|
||
Shutdown is right, of course. The Components object's prototype is a regular [object Object], not an XPC wrapped native prototype. Adding a null check here to continue around the loop seems to be the correct thing to do, since if the current wrapper doesn't have a prototype, then we can't possibly be looking at the correct object.
Priority: -- → P1
Whiteboard: [patch]
Target Milestone: --- → mozilla1.9alpha
|
|
Assignee | |
Comment 5•19 years ago
|
||
|
||
Comment 6•19 years ago
|
||
Comment on attachment 212640 [details] [diff] [review]
Proposed fix
r=jst
Attachment #212640 -
Flags: review?(jst) → review+
|
|
Assignee | |
Updated•19 years ago
|
Attachment #212640 -
Flags: superreview?(bzbarsky)
|
||
Updated•19 years ago
|
Attachment #212640 -
Flags: superreview?(bzbarsky) → superreview+
|
|
Assignee | |
Comment 7•19 years ago
|
||
Fix checked into trunk.
Status: ASSIGNED → RESOLVED
Closed: 19 years ago
Resolution: --- → FIXED
|
|
Assignee | |
Comment 9•19 years ago
|
||
*** Bug 328023 has been marked as a duplicate of this bug. ***
|
||
Comment 10•19 years ago
|
||
Should this regression be fixed on the 1.8 and maybe 1.8.0 branches also?
Flags: blocking1.8.1?
Flags: blocking1.8.0.5?
|
|
Assignee | |
Comment 11•19 years ago
|
||
(In reply to comment #10)
> Should this regression be fixed on the 1.8 and maybe 1.8.0 branches also?
This seems to me to be a low-risk, high-reward bug that fixes a regression from split windows.
|
|
||
Updated•19 years ago
|
Flags: blocking1.8.1?
Flags: blocking1.8.1+
Flags: blocking1.8.0.5?
Flags: blocking1.8.0.5+
|
|
Assignee | |
Updated•19 years ago
|
Attachment #212640 -
Flags: approval1.8.0.5?
Attachment #212640 -
Flags: approval-branch-1.8.1?(shaver)
|
|
||
Comment 12•19 years ago
|
||
Comment on attachment 212640 [details] [diff] [review]
Proposed fix
approved for 1.8.0 branch, a=dveditz for drivers
Attachment #212640 -
Flags: approval1.8.0.5?
Attachment #212640 -
Flags: approval1.8.0.5+
Attachment #212640 -
Flags: approval-branch-1.8.1?(shaver)
Attachment #212640 -
Flags: approval-branch-1.8.1+
|
|
Assignee | |
Comment 13•19 years ago
|
||
Fix checked into the 1.8 branches.
Keywords: fixed1.8.0.5,
fixed1.8.1
|
||
Comment 14•19 years ago
|
||
verified with:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.5) Gecko/20060620 Firefox/1.5.0.5
Keywords: fixed1.8.0.5 → verified1.8.0.5
|
||
Comment 15•19 years ago
|
||
Verified FIXED on the 1.8 branch using Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1b1) Gecko/20060815 BonEcho/2.0b1 and the testcase from comment 1.
Keywords: fixed1.8.1 → verified1.8.1
|
||
Updated•14 years ago
|
Crash Signature: [@ GetWrappedNativeOfJSObject]
You need to log in
before you can comment on or make changes to this bug.
Description
•