Closed Bug 603531 Opened 12 years ago Closed 12 years ago

"ASSERTION: bad outer object hook" and crash [@ js::gc::Cell::compartment]

Categories

(Core :: XPConnect, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- beta7+

People

(Reporter: jruderman, Assigned: peterv)

References

Details

(Keywords: assertion, crash, testcase, Whiteboard: fixed-in-tracemonkey)

Crash Data

Attachments

(3 files)

On TM branch, post-Compartments-landing:

ASSERTION: bad outer object hook!: 'flat', 
file js/src/xpconnect/src/xpcconvert.cpp

Crash [@ js::gc::Cell::compartment]
blocking2.0: --- → ?
Attached file stack traces
Assignee: nobody → peterv
Status: NEW → ASSIGNED
blocking2.0: ? → beta7+
Attached patch v1Splinter Review
We need to make the inner window hold a strong reference to its outer.
Attachment #482699 - Flags: review?(mrbkap)
Comment on attachment 482699 [details] [diff] [review]
v1

>@@ -1652,16 +1650,18 @@ nsGlobalWindow::SetNewDocument(nsIDocume
> 
>   if (IsFrozen()) {
>     // This outer is now getting its first inner, thaw the outer now
>     // that it's ready and is getting an inner window.
> 
>     Thaw();
>   }
> 
>+  // XXX Brain transplant outer window JSObject and create new one!

No need for this comment to come back.
Attachment #482699 - Flags: review?(mrbkap) → review+
http://hg.mozilla.org/mozilla-central/rev/d468bf98f7a1
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Blocks: 580128
Crash Signature: [@ js::gc::Cell::compartment]
You need to log in before you can comment on or make changes to this bug.