Closed Bug 418776 Opened 13 years ago Closed 13 years ago
Assertion failure: !OBJ
_GET _PARENT(cx, obj), at mozilla/js/src/jsobj .c:2648
331 bytes, text/html
4.68 KB, text/plain
743 bytes, patch
|Details | Diff | Splinter Review|
The attached testcase causes a fatal (in debug builds) assertion in the JS engine: !OBJ_GET_PARENT(cx, obj), at mozilla/js/src/jsobj.c:2648. I ran into this on a current trunk debug build while modifying a testcase based on the one in bug #313462 comment #13. Originally seen on a Mac build, but also reproduced on a few day old Linux build. I'll add the complete backtrace as an attachment since backtraces aren't particularly readable when pasted into comments.
I don't crash with a debug build from this morning. Perhaps fixed by bug 418540 ?
I can still reproduce this. A key point I didn't realise earlier is that the testcase must be loaded via file:///.
confirmed, file:/// only crash. :-/
This looks more like a DOM bug to me.
Assignee: general → nobody
QA Contact: general → general
I get this any time I do alert(window.frames) and that frame is cross-origin. I will lay bets this is XOW fallout. We should fix this.
Component: DOM → XPConnect
QA Contact: general → xpconnect
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Verified fixed using the testcase and Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008050614 Minefield/3.0pre + on Mac 10.5 I get no error when i load the testcase, the only "error" in the Debug Output/Error Console is : Error: A script from "https://bugzilla.mozilla.org" was denied UniversalBrowserRead privileges. Source File: https://bugzilla.mozilla.org/attachment.cgi?id=304664 Line: 5 but i think this is expected -> Verified fixed
Status: RESOLVED → VERIFIED
Carsten, note that this was only easily reproducible in a debug build; I'm not sure there were any obvious issues visible in a nightly for this bug.
fwiw, I can't reproduce the assertion failure with today's debug build on centos5 with either the bugzilla attachment or a version loaded from file: after granting the access.
You need to log in before you can comment on or make changes to this bug.