345022 - ASSERTION: XPConnect is being called on a scope without a 'Components' property! (using setUserData)

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Mats Palmgren (inactive)]

pure virtual method called, [@ nsContentUtils::CallUserDataHandler]

STEPS TO REPRODUCE
1. load testcase in a trunk debug build
2. push the button -> crash

The crash is in NS_DEBUG code here:
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/content/base/src/nsContentUtils.cpp&rev=1.170&root=/cvsroot&mark=3187#3180

When I removed that NS_DEBUG block I got this instead (no crash though):

###!!! ASSERTION: XPConnect is being called on a scope without a 'Components' property!

This is pretty much always bad. It usually means that native code is
making a callback to an interface implemented in JavaScript, but the
document where the JS object was created has already been cleared and the
global properties of that document's window are *gone*. Generally this
indicates a problem that should be addressed in the design and use of the
callback code.
: 'Error', file xpcwrappednativescope.cpp, line 587
An error occurred updating the cmd_copy command

Comment 1

[Mats Palmgren (inactive)]

Attachment: stack

Comment 2

[Mats Palmgren (inactive)]

Attachment: Testcase

Comment 3

[Mats Palmgren (inactive)]

*** Bug 345533 has been marked as a duplicate of this bug. ***

Comment 4

[Jesse Ruderman]

"Pure virtual method called" usually means code is incorrectly calling virtual functions from a destructor, perhaps indirectly.  In particular, calling virtual methods on a derived class during a base class's destructor will not do what you want.

Comment 5

[Mats Palmgren (inactive)]

It seems bug 330677 fixed the crash:
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/content/base/src/nsContentUtils.cpp&rev=1.174&root=/cvsroot&mark=3211#3206

The assertion is still present. Not sure if that's a security issue though.

Comment 6

[Jesse Ruderman]

WFM on Mac trunk.  The only problem I see is this warning:

WARNING: Moving XPConnect wrappedNative to new scope, but can't fixup __proto__: file /Users/jruderman/trunk/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp, line 1174

Comment 7

[chris hofmann]

mats, still a problem?

Comment 8

[Mats Palmgren (inactive)]

No crash or assertion with the testcase, FF trunk Linux and Mac debug builds.

We could probably make it into a crashtest.

-> WORKSFORME