418776 - Assertion failure: !OBJ_GET_PARENT(cx, obj), at mozilla/js/src/jsobj.c:2648

Status: VERIFIED FIXED

(Core :: XPConnect, defect, P2)

Description

[Matthew Gregan [:kinetik]]

Attachment: testcase (warning: causes current debug trunk to assert and fatally abort)

The attached testcase causes a fatal (in debug builds) assertion in the JS engine: !OBJ_GET_PARENT(cx, obj), at mozilla/js/src/jsobj.c:2648.  I ran into this on a current trunk debug build while modifying a testcase based on the one in bug #313462 comment #13.  Originally seen on a Mac build, but also reproduced on a few day old Linux build.

I'll add the complete backtrace as an attachment since backtraces aren't particularly readable when pasted into comments.

Comment 1

[Matthew Gregan [:kinetik]]

Attachment: backtrace

Comment 2

[Bob Clary [:bc] (inactive)]

I don't crash with a debug build from this morning. Perhaps fixed by bug 418540 ?

Comment 3

[Matthew Gregan [:kinetik]]

I can still reproduce this.  A key point I didn't realise earlier is that the testcase must be loaded via file:///.

Comment 4

[Bob Clary [:bc] (inactive)]

confirmed, file:/// only crash. :-/

Comment 5

[Brian Crowder]

This looks more like a DOM bug to me.

Comment 6

[Boris Zbarsky [:bzbarsky]]

I get this any time I do alert(window.frames[0]) and that frame is cross-origin.  I will lay bets this is XOW fallout.  We should fix this.

Comment 7

[Johnny Stenback (:jst)]

Attachment: Don't resolve standard classes on non-global objects.

Comment 8

[Johnny Stenback (:jst)]

Fixed.

Comment 9

[Carsten Book [:Tomcat]]

Verified fixed using the testcase and Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008050614 Minefield/3.0pre + on Mac 10.5

I get no error when i load the testcase, the only "error" in the Debug Output/Error Console is :

Error: A script from "https://bugzilla.mozilla.org" was denied UniversalBrowserRead privileges.
Source File: https://bugzilla.mozilla.org/attachment.cgi?id=304664
Line: 5

but i think this is expected -> Verified fixed

Comment 10

[Boris Zbarsky [:bzbarsky]]

Carsten, note that this was only easily reproducible in a debug build; I'm not sure there were any obvious issues visible in a nightly for this bug.

Comment 11

[Bob Clary [:bc] (inactive)]

fwiw, I can't reproduce the assertion failure with today's debug build on centos5 with either the bugzilla attachment or a version loaded from file: after granting the access.