Closed Bug 517711 Opened 15 years ago Closed 15 years ago

###!!! ASSERTION: Wrong scope, this is really bad!: 'JS_GetGlobalForObject(cx, o bj) == newScope'

Categories

(Core :: General, defect)

1.9.1 Branch
x86
Windows XP
defect
Not set
normal

Tracking

()

RESOLVED DUPLICATE of bug 502730
Tracking Status
status1.9.1 --- wanted

People

(Reporter: cbook, Unassigned)

Details

(Whiteboard: [sg:dupe 502730] (false-positive assertion))

Steps to reproduce: 1.9.1 Debug build -> Load http://os.icloud.com/ff.html --> Cause Assertion ###!!! ASSERTION: Wrong scope, this is really bad!: 'JS_GetGlobalForObject(cx, o bj) == newScope', file c:/work/mozilla/builds/1.9.1/mozilla/content/base/src/nsDocument.cpp, line 3612 gklayout!nsGlobalWindow::SetNewDocument+0x0000000000001765 (c:\work\mozilla\builds\1.9.1\mozilla\dom\src\base\nsglobalwindow.cpp, line 1973) gklayout!nsGlobalWindow::SetNewDocument+0x000000000000017C (c:\work\mozilla\builds\1.9.1\mozilla\dom\src\base\nsglobalwindow.cpp, line 1577) gklayout!nsGlobalWindow::SetNewDocument+0x000000000000001D (c:\work\mozilla\builds\1.9.1\mozilla\dom\src\base\nsglobalwindow.cpp, line 1536) gklayout!nsHTMLDocument::OpenCommon+0x000000000000071F (c:\work\mozilla\builds\1.9.1\mozilla\content\html\document\src\nshtmldocument.cpp, line 1921) gklayout!nsHTMLDocument::Open+0x000000000000001C (c:\work\mozilla\builds\1.9.1\mozilla\content\html\document\src\nshtmldocument.cpp, line 2074) gklayout!nsHTMLDocumentSH::DocumentOpen+0x00000000000003A6 (c:\work\mozilla\builds\1.9.1\mozilla\dom\src\base\nsdomclassinfo.cpp, line 8281) js3250!js_Invoke+0x0000000000000916 (c:\work\mozilla\builds\1.9.1\mozilla\js\src\jsinterp.cpp, line 1386) js3250!js_Interpret+0x00000000000118EB (c:\work\mozilla\builds\1.9.1\mozilla\js\ src\jsinterp.cpp, line 5179) js3250!js_Invoke+0x000000000000095C (c:\work\mozilla\builds\1.9.1\mozilla\js\src\jsinterp.cpp, line 1394) js3250!js_InternalInvoke+0x0000000000000082 (c:\work\mozilla\builds\1.9.1\mozilla\js\src\jsinterp.cpp, line 1447) js3250!JS_CallFunctionValue+0x000000000000005D (c:\work\mozilla\builds\1.9.1\mozilla\js\src\jsapi.cpp, line 5187) gklayout!nsJSContext::CallEventHandler+0x00000000000002A0 (c:\work\mozilla\builds\1.9.1\mozilla\dom\src\base\nsjsenvironment.cpp, line 2085) gklayout!nsJSEventListener::HandleEvent+0x00000000000010D9 (c:\work\mozilla\builds\1.9.1\mozilla\dom\src\events\nsjseventlistener.cpp, line 247) gklayout!nsEventListenerManager::HandleEventSubType+0x0000000000000195 (c:\work\mozilla\builds\1.9.1\mozilla\content\events\src\nseventlistenermanager.cpp, line1098) gklayout!nsEventListenerManager::HandleEvent+0x0000000000000398 (c:\work\mozilla\builds\1.9.1\mozilla\content\events\src\nseventlistenermanager.cpp, line 1208) gklayout!nsEventTargetChainItem::HandleEvent+0x0000000000000130 (c:\work\mozilla\builds\1.9.1\mozilla\content\events\src\nseventdispatcher.cpp, line 237) gklayout!nsEventTargetChainItem::HandleEventTargetChain+0x0000000000000194 (c:\work\mozilla\builds\1.9.1\mozilla\content\events\src\nseventdispatcher.cpp, line302) gklayout!nsEventDispatcher::Dispatch+0x000000000000051E (c:\work\mozilla\builds\1.9.1\mozilla\content\events\src\nseventdispatcher.cpp, line 514) gklayout!nsScriptElement::ScriptEvaluated+0x00000000000000AD (c:\work\mozilla\builds\1.9.1\mozilla\content\base\src\nsscriptelement.cpp, line 105) gklayout!nsScriptLoadRequest::FireScriptEvaluated+0x000000000000003D (c:\work\mozilla\builds\1.9.1\mozilla\content\base\src\nsscriptloader.cpp, line 98) gklayout!nsScriptLoader::FireScriptEvaluated+0x000000000000008A (c:\work\mozilla\builds\1.9.1\mozilla\content\base\src\nsscriptloader.cpp, line 631) gklayout!nsScriptLoader::ProcessRequest+0x0000000000000113 (c:\work\mozilla\builds\1.9.1\mozilla\content\base\src\nsscriptloader.cpp, line 603) gklayout!nsScriptLoader::ProcessPendingRequests+0x000000000000006E (c:\work\mozilla\builds\1.9.1\mozilla\content\base\src\nsscriptloader.cpp, line 741) gklayout!nsScriptLoader::OnStreamComplete+0x00000000000000D1 (c:\work\mozilla\builds\1.9.1\mozilla\content\base\src\nsscriptloader.cpp, line 929) necko!nsStreamLoader::OnStopRequest+0x000000000000006A (c:\work\mozilla\builds\1.9.1\mozilla\netwerk\base\src\nsstreamloader.cpp, line 110) necko!nsHTTPCompressConv::OnStopRequest+0x0000000000000023 (c:\work\mozilla\builds\1.9.1\mozilla\netwerk\streamconv\converters\nshttpcompressconv.cpp, line 128) necko!nsStreamListenerTee::OnStopRequest+0x00000000000000A8 (c:\work\mozilla\builds\1.9.1\mozilla\netwerk\base\src\nsstreamlistenertee.cpp, line 66) necko!nsHttpChannel::OnStopRequest+0x00000000000003E9 (c:\work\mozilla\builds\1.9.1\mozilla\netwerk\protocol\http\src\nshttpchannel.cpp, line 4985) necko!nsInputStreamPump::OnStateStop+0x00000000000000DE (c:\work\mozilla\builds\1.9.1\mozilla\netwerk\base\src\nsinputstreampump.cpp, line 577) necko!nsInputStreamPump::OnInputStreamReady+0x0000000000000090 (c:\work\mozilla\builds\1.9.1\mozilla\netwerk\base\src\nsinputstreampump.cpp, line 401) xpcom_core!nsInputStreamReadyEvent::Run+0x000000000000004A (c:\work\mozilla\builds\1.9.1\mozilla\xpcom\io\nsstreamutils.cpp, line 112) xpcom_core!nsThread::ProcessNextEvent+0x00000000000001FA (c:\work\mozilla\builds\1.9.1\mozilla\xpcom\threads\nsthread.cpp, line 522) xpcom_core!NS_ProcessNextEvent_P+0x0000000000000053 (c:\work\mozilla\builds\1.9.1\mozilla\firefox-debug\xpcom\build\nsthreadutils.cpp, line 227) gkwidget!nsBaseAppShell::Run+0x000000000000005D (c:\work\mozilla\builds\1.9.1\mozilla\widget\src\xpwidgets\nsbaseappshell.cpp, line 170) tkitcmps!nsAppStartup::Run+0x000000000000006B (c:\work\mozilla\builds\1.9.1\mozilla\toolkit\components\startup\src\nsappstartup.cpp, line 193) xul!XRE_main+0x0000000000003000 (c:\work\mozilla\builds\1.9.1\mozilla\toolkit\xre\nsapprunner.cpp, line 3321) firefox!NS_internal_main+0x00000000000002B2 (c:\work\mozilla\builds\1.9.1\mozilla\browser\app\nsbrowserapp.cpp, line 156) firefox!wmain+0x0000000000000119 (c:\work\mozilla\builds\1.9.1\mozilla\toolkit\xre\nswindowswmain.cpp, line 110) firefox!__tmainCRTStartup+0x00000000000001A6 (f:\dd\vctools\crt_bld\self_x86\crt\src\crtexe.c, line 594) firefox!wmainCRTStartup+0x000000000000000D (f:\dd\vctools\crt_bld\self_x86\crt\src\crtexe.c, line 414) kernel32!RegisterWaitForInputIdle+0x0000000000000049
taking the assertion's "this is really bad!" at its word. Tomcat: do you get the same result in a more recent build? an older (1.9.0.x) build? if we know we're looking for a regression or fix range that can help pin-point the problem. I'd like to preserve the testcase, but it's using XHR and stuff that we probably can't easily replicate just by trying to take a copy of the whole page. Is this a JS/xpconnect bug or misuse by content?
Whiteboard: [sg:critical?]
That assertion is probably bogus in this case, dupe of bug 502730?
(In reply to comment #1) > taking the assertion's "this is really bad!" at its word. > > Tomcat: do you get the same result in a more recent build? an older (1.9.0.x) > build? if we know we're looking for a regression or fix range that can help > pin-point the problem. > only can reproduce this on 1.9.1 - 1.9.0 seems fine > I'd like to preserve the testcase, but it's using XHR and stuff that we > probably can't easily replicate just by trying to take a copy of the whole > page. > > Is this a JS/xpconnect bug or misuse by content? indeed, saved the local copy of the page but not able to reproduce so far
note: during crash automation testing this assertion was also reported for http://www.ustream.tv/channel/athene-poker on Windows 7 on 1.9.1 debug build
Is this a dup of bug 502730 as peter suggests? I don't think this is critical if the reason for the critical was the wording of the assert -- worth getting domain analysis if you disagree, though! Putting back in for re-triage.
Whiteboard: [sg:critical?] → [sg:needs-triage]
The patch from bug 502730 fixes this too.
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → DUPLICATE
Group: core-security
Whiteboard: [sg:needs-triage] → [sg:dupe 502730] (false-positive assertion)
You need to log in before you can comment on or make changes to this bug.