592741 - TM: set right compartment in nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gregor Wagner [:gwagner]]

Assertion failure: cx->compartment != cx->runtime->defaultCompartment, at /Users/idefix2/moz/ws1/js/src/jsapi.cpp:4888

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
0x00000001018dcfaa in JS_Assert (s=0x101cc1d20 "cx->compartment != cx->runtime->defaultCompartment", file=0x101cc1758 "/Users/idefix2/moz/ws1/js/src/jsapi.cpp", ln=4888) at /Users/idefix2/moz/ws1/js/src/jsutil.cpp:80
80	    *((int *) NULL) = 0;  /* To continue from here in GDB: "return" then "continue". */
(gdb) bt
#0  0x00000001018dcfaa in JS_Assert (s=0x101cc1d20 "cx->compartment != cx->runtime->defaultCompartment", file=0x101cc1758 "/Users/idefix2/moz/ws1/js/src/jsapi.cpp", ln=4888) at /Users/idefix2/moz/ws1/js/src/jsutil.cpp:80
#1  0x000000010177448b in JS_CallFunctionValue (cx=0x11780f8f0, obj=0x11881e310, fval={asBits = 18445477441020481760, debugView = {payload47 = 4706128096, tag = JSVAL_TAG_OBJECT}, s = {payload = {i32 = 411160800, u32 = 411160800, why = 411160800}}, asDouble = -nan(0xb80011881d0e0)}, argc=1, argv=0x7fff5fbfe8c0, rval=0x7fff5fbfe930) at /Users/idefix2/moz/ws1/js/src/jsapi.cpp:4888
#2  0x0000000100e666ae in nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject (this=0x10691dbf0, ccx=@0x7fff5fbfeae0, jsobj=0x11881e310, aIID=@0x101cf28a0) at /Users/idefix2/moz/ws1/js/src/xpconnect/src/xpcwrappedjsclass.cpp:318
#3  0x0000000100e67c32 in nsXPCWrappedJSClass::DelegatedQueryInterface (this=0x10691dbf0, self=0x10691dd50, aIID=@0x101cf28a0, aInstancePtr=0x7fff5fbfece8) at /Users/idefix2/moz/ws1/js/src/xpconnect/src/xpcwrappedjsclass.cpp:797
#4  0x0000000100e5c5e8 in nsXPCWrappedJS::QueryInterface (this=0x10691dd50, aIID=@0x101cf28a0, aInstancePtr=0x7fff5fbfece8) at /Users/idefix2/moz/ws1/js/src/xpconnect/src/xpcwrappedjs.cpp:185
#5  0x00000001015be663 in nsXPTCStubBase::QueryInterface (this=0x10691ddd0, aIID=@0x101cf28a0, aInstancePtr=0x7fff5fbfece8) at /Users/idefix2/moz/ws1/xpcom/reflect/xptcall/src/xptcall.cpp:53
#6  0x0000000101523a66 in nsQueryInterfaceWithError::operator() (this=0x7fff5fbfed80, aIID=@0x101cf28a0, answer=0x7fff5fbfece8) at nsCOMPtr.cpp:64
#7  0x0000000100fce117 in nsCOMPtr<nsIObserver>::assign_from_qi_with_error (this=0x7fff5fbfedf0, qi=@0x7fff5fbfed80, aIID=@0x101cf28a0) at nsCOMPtr.h:1222
#8  0x0000000100fce171 in nsCOMPtr<nsIObserver>::nsCOMPtr (this=0x7fff5fbfedf0, qi=@0x7fff5fbfed80) at nsCOMPtr.h:603
#9  0x0000000100fcdb97 in nsAppStartupNotifier::Observe (this=0x11780f270, aSubject=0x0, aTopic=0x101b7f55a "app-startup", someData=0x0) at /Users/idefix2/moz/ws1/embedding/components/appstartup/src/nsAppStartupNotifier.cpp:107
#10 0x000000010002dd37 in XRE_main (argc=1, argv=0x7fff5fbff8b8, aAppData=0x105515ec0) at /Users/idefix2/moz/ws1/toolkit/xre/nsAppRunner.cpp:3494
#11 0x0000000100001297 in main (argc=1, argv=0x7fff5fbff8b8) at /Users/idefix2/moz/ws1/browser/app/nsBrowserApp.cpp:158

Comment 1

[Gregor Wagner [:gwagner]]

Attachment: patch

Comment 2

[Gregor Wagner [:gwagner]]

http://hg.mozilla.org/tracemonkey/rev/ae39ca0f53d3

Comment 3

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/mozilla-central/rev/ae39ca0f53d3