Closed Bug 499777 Opened 11 years ago Closed 11 years ago

Cannot convert WrappedNative to function (NS_ERROR_XPC_CANT_CONVERT_WN_TO_FUN)

Categories

(Core :: DOM: Core & HTML, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
Tracking Status
status1.9.2 --- beta1-fixed

People

(Reporter: nathan, Assigned: peterv)

References

()

Details

(Keywords: regression)

Attachments

(1 file, 2 obsolete files)

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-US; rv:1.9.2a1pre) Gecko/20090621 Minefield/3.6a1pre
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-US; rv:1.9.2a1pre) Gecko/20090622 Minefield/3.6a1pre

Get this bug every time I try to extend Event using MooTools or jQuery with the nightly builds since the 22nd of June:

exception: [Exception... "Cannot convert WrappedNative to function"  nsresult: "0x8057000d (NS_ERROR_XPC_CANT_CONVERT_WN_TO_FUN)"  location: "JS frame :: http://xxx/js/main_mootools_core.js :: anonymous :: line 2028"  data: no]

The 21st is dandy, so I checked the checkins for that night, and it appears to be because of this:

http://hg.mozilla.org/mozilla-central/rev/dca035c2bb32

That changeset links to a private bug, #498897, which I'm guessing is hidden for security reasons.

Reproducible: Always

Steps to Reproduce:
1. Navigate to http://www.stufftodo.com.au/.
2. Submit the form on the home page which searches the map.
3. The JavaScript should catch the form submit event using MooTools.
Actual Results:  
Seems to crash and burn on most event handlers with the above error.

Expected Results:  
Should catch the event and continue executing the JavaScript.

Seems to point to this line in MooTools Core, the line it fails on every time:


event = new Event(event, self.getWindow());

which is inside the AddEvent method that gets tacked onto Element, Document and Window.
It seems most Facebook Applications don't work with latest trunk because of this issue.
Component: General → DOM
OS: Mac OS X → All
Product: Firefox → Core
QA Contact: general → general
Hardware: PowerPC → All
Version: unspecified → Trunk
Status: UNCONFIRMED → NEW
Ever confirmed: true
hg bisect identified the culprit as:

The first bad revision is:
changeset:   29403:a0a62342aacb
user:        Peter Van der Beken <peterv@propagandism.org>
date:        Wed Jun 03 17:30:18 2009 +0200
summary:     Fix for bug 484764 (Set up DOM prototype chains from PostCreateProto instead of PostCreate). r/sr=jst.
Flags: wanted1.9.2?
Keywords: regression
Blocks: 484764
Unfortunatlely I ma unable to unmark bug 498897 as the cause as it is a security bug and I do not have permission to do so.
Flags: wanted1.9.2? → blocking1.9.2?
No longer blocks: CVE-2009-2665
Assignee: nobody → peterv
Status: NEW → ASSIGNED
Attached patch v1 (obsolete) — Splinter Review
Grmbl, Mootools does |var Event = ...|. I'll write a mochitest.
Attachment #384581 - Flags: superreview?(mrbkap)
Attachment #384581 - Flags: review?(mrbkap)
Attachment #384581 - Flags: superreview?(mrbkap)
Attachment #384581 - Flags: superreview+
Attachment #384581 - Flags: review?(mrbkap)
Attachment #384581 - Flags: review+
http://hg.mozilla.org/mozilla-central/rev/c8297c309ab3
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Flags: in-testsuite?
Resolution: --- → FIXED
(In reply to comment #4)
> Created an attachment (id=384581) [details]
> v1
> 
> Grmbl, Mootools does |var Event = ...|. I'll write a mochitest.

This might fix the originally reported case, but does not appear to fix the facebook issue.

In my own build including this fix I still see an issue in facebook.

I still get tons of this error:

Error: Cannot convert WrappedNative to function = NS_ERROR_XPC_CANT_CONVERT_WN_TO_FUN
Source file: http://b.static.ak.fbcdn.net/rsrc.php/zCEFQ/lpkg/1nmolu57/en_US/141/168649/js/d74arak6ngo4484c.pkg.js
Line: 384

where that line appears to be:

list=new NodeList();list.push.apply(list,$A(candidates));}else{list=candidates;}

Should I file a separate bug?
seeing errors here as well:

Error: Cannot convert WrappedNative to function = NS_ERROR_XPC_CANT_CONVERT_WN_TO_FUN
Source file: http://b.static.ak.fbcdn.net/rsrc.php/zCEFQ/lpkg/1nmolu57/en_US/141/168649/js/d74arak6ngo4484c.pkg.js
Line: 412

return true;},NODE_TYPES:{ELEMENT:1,ATTRIBUTE:2,TEXT:3,CDATA_SECTION:4,ENTITY_REFERENCE:5,ENTITY:6,PROCESSING_INSTRUCTION:7,COMMENT:8,DOCUMENT:9,DOCUMENT_TYPE:10,DOCUMENT_FRAGMENT:11,NOTATION_NODE:12},_addContent:function(content,append_fn,target_element){var item,elements=new NodeList(),callbacks=[];var fragment=document.createDocumentFragment();if(!(content instanceof Array)){content=[content];}
Backed out, breaks content/canvas/test/test_2d.type.delete.html and content/canvas/test/test_type.delete.html.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
(In reply to comment #6)
> Should I file a separate bug?

Hard to say without a reduced testcase.
Someone else filed bug 500025 on the facebook issue I am copying the info from my last 2 comments there.
Attached patch v2 (obsolete) — Splinter Review
So I think the issue is that we were actually overwriting properties set by content script. Bill, can you check if this fixes the facebook issue too?
Attachment #384581 - Attachment is obsolete: true
Attached patch v2.1Splinter Review
Attachment #384701 - Attachment is obsolete: true
Attachment #384711 - Flags: superreview?(mrbkap)
Attachment #384711 - Flags: review?(mrbkap)
Duplicate of this bug: 500025
Comment on attachment 384711 [details] [diff] [review]
v2.1

>+  if (::JS_AlreadyHasOwnUCProperty(cx, global, mData->mNameUTF16,
>+                                   nsCRT::strlen(mData->mNameUTF16), &found) &&
>+      found) {
>+    return NS_OK;

If JS_AlreadyhasOwnUCProperty returns false, it means that someone probably threw an exception (or no exception if OOM) so we should either propagate the failure or JS_ClearPendingException(cx). r+sr=mrbkap with that addressed.
Attachment #384711 - Flags: superreview?(mrbkap)
Attachment #384711 - Flags: superreview+
Attachment #384711 - Flags: review?(mrbkap)
Attachment #384711 - Flags: review+
(In reply to comment #12)
> Created an attachment (id=384711) [details]
> v2.1

I am unable to reproduce the issues I had previously experienced with facebook issues using a build that includes this patch.
http://hg.mozilla.org/mozilla-central/rev/c84e00e1db7c

I made a slight change to the patch: I only made us not define the constructor on the global object, but still do all the other stuff in ResolvePrototype (setting up proto chain, ...). Since the problem comes from overwriting a property with the constructor the bug should still be fixed.

Mochitest coming up.
Status: REOPENED → RESOLVED
Closed: 11 years ago11 years ago
Resolution: --- → FIXED
Hi, I still get the very same errors on my Netvibes.com homepage:

Error: uncaught exception: [Exception... "Cannot convert WrappedNative to function"  nsresult: "0x8057000d (NS_ERROR_XPC_CANT_CONVERT_WN_TO_FUN)"  location: "JS frame :: http://cdn.netvibes.com/js/c/Netvibes.js?v=786 :: anonymous :: line 1"  data: no]

Build Identifier is Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2a1pre) Gecko/20090623 Minefield/3.6a1pre
(In reply to comment #17)
> Hi, I still get the very same errors on my Netvibes.com homepage:
> 
> Error: uncaught exception: [Exception... "Cannot convert WrappedNative to
> function"  nsresult: "0x8057000d (NS_ERROR_XPC_CANT_CONVERT_WN_TO_FUN)" 
> location: "JS frame :: http://cdn.netvibes.com/js/c/Netvibes.js?v=786 ::
> anonymous :: line 1"  data: no]
> 
> Build Identifier is Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2a1pre)
> Gecko/20090623 Minefield/3.6a1pre

You need to install a build from after the fix was landed. There should be a new nightly out with in the next hour or so.
Thanks a lot, it seems to be working as expected (using today's build).
Can confirm this is fixed in the latest nightly build.
Duplicate of this bug: 500364
Flags: blocking1.9.2? → blocking1.9.2+
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.