400349 - Touching node in removed iframe triggers "ASSERTION: XPConnect is being called on a scope without a 'Components' property!"

Status: RESOLVED WORKSFORME

(Core :: XPConnect, defect)

Description

[Jesse Ruderman]

Attachment: testcase

This is a re-filing of bug 323978 without the irrelevant and confidential parts.

Loading the testcase triggers:

###!!! ASSERTION: XPConnect is being called on a scope without a 'Components' property!: 'Error', file /Users/jruderman/trunk/mozilla/js/src/xpconnect/src/xpcwrappednativescope.cpp, line 659

How bad is this?

Comment 1

[Jesse Ruderman]

Attachment: mrbkap's "incomplete patch"

When mrbkap attached this patch to bug 323978, he said "This fixes a reduced testcase that I have, but not the problem in general, as I see crashes...".

Some crash bugs (including bug 321299) were fixed since then.  Does this patch fix all the remaining issues?

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 285441 [details] [diff] [review]
mrbkap's "incomplete patch"

A completed version of this patch was checked in for bug 321299.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

(In reply to comment #1)
> Some crash bugs (including bug 321299) were fixed since then.  Does this patch
> fix all the remaining issues?

The remaining issue here is that we call JS_ClearScope on windows when the window is closed (or the iframe is removed, in this case). While this is an "inconsistent" state, it's not a security problem and the effects are mainly the assertion, and (as indicated by the assertion) things like Components and other properties won't be available.

Comment 5

[Jesse Ruderman]

WFM.

Blake, is the issue you mentioned in comment 4 still around?  If it is, can you spin it off into a new bug?

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

(In reply to comment #5)
> Blake, is the issue you mentioned in comment 4 still around?  If it is, can you
> spin it off into a new bug?

It's been filed as bug 470510.