"ASSERTION: Inner window detected in Equality hook!" at Gmail

RESOLVED FIXED in mozilla1.9beta4

Status

()

Core
DOM
P1
normal
RESOLVED FIXED
10 years ago
10 years ago

People

(Reporter: Jesse Ruderman, Assigned: mrbkap)

Tracking

({assertion})

Trunk
mozilla1.9beta4
x86
All
assertion
Points:
---
Bug Flags:
blocking1.9 +
wanted1.8.1.x -

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: post 1.8 branch, URL)

Attachments

(2 attachments)

(Reporter)

Description

10 years ago
Loading https://mail.google.com/mail/ (I'm logged in) gives me a bunch of:

###!!! ASSERTION: Inner window detected in Equality hook!: 'other->IsOuterWindow()', file /Users/jruderman/trunk/mozilla/dom/src/base/nsDOMClassInfo.cpp, line 6268

I get a bunch more when I close the window, too.

Initially security-sensitive because bug 394012 is security-sensitive and full of private comments.
Duplicate of this bug: 419204

Comment 2

10 years ago
Created attachment 305291 [details]
testcase

reduced from http://www.howtoforge.com/jquery/jquery-latest.pack.js

if (window==this) {}

Updated

10 years ago
Duplicate of this bug: 419773
I can reproduce assertion with test in comment 2. This is the second most common assertion on linux on the top sites.
Flags: blocking1.9?
OS: Mac OS X → All
Created attachment 306939 [details] [diff] [review]
Proposed fix

We're computing |this| here, so we need to outerize.
Assignee: nobody → mrbkap
Status: NEW → ASSIGNED
Attachment #306939 - Flags: review?(brendan)
Guessing at the TM.
Priority: -- → P2
Target Milestone: --- → mozilla1.9beta4
Note to drivers: this should block as this patch fixes the important part of bug 420480.
Flags: blocking1.9? → blocking1.9+
Priority: P2 → P1
Does this need to block beta 4?
Apparently it does! a1.9b4=beltzner once we have a reviewed patch.
Comment on attachment 306939 [details] [diff] [review]
Proposed fix

beltzner telegraphed this too.

/be
Attachment #306939 - Flags: review?(brendan)
Attachment #306939 - Flags: review+
Attachment #306939 - Flags: approval1.9b4+
Attachment #306939 - Flags: approval1.9+
Fixed:

js/src/jsinterp.c 3.459

/be
Status: ASSIGNED → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
(Reporter)

Comment 12

10 years ago
Should I check in Andrew's testcase as a crashtest once beta 4 ships?  Or can this be tested using a pure-JS-engine testcase?
I can't do ASSERTION unless its fatal. Are the crashtests run with fatal assertions?

Comment 14

10 years ago
Not yet, sadly; it requires tinderboxen with fatal assertions, which requires debug tinderboxen, which requires a ton of effort to get them up to snuff enough to be able to run everything without failing.  (There's at least one on MozillaTest which isn't doing so well and needs developer and probably admin love both.)  For now we just commit and plan to deal with asserts when we have the ability to do so on tinderboxen.  :-\
Group: security
Flags: wanted1.8.1.x-
Whiteboard: post 1.8 branch
You need to log in before you can comment on or make changes to this bug.