Closed Bug 603531 Opened 13 years ago Closed 13 years ago

"ASSERTION: bad outer object hook" and crash [@ js::gc::Cell::compartment]

Categories

(Core :: XPConnect, defect)

Product:
Core
Component:
XPConnect
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
blocking2.0 --- beta7+

People

(Reporter: jruderman, Assigned: peterv)

References

Details

(Keywords: assertion, crash, testcase, Whiteboard: fixed-in-tracemonkey)

Crash Data

Attachments

(3 files)

testcase (crashes Firefox when loaded)
382 bytes, text/html
Details
stack traces
61.38 KB, text/plain
Details
v1
11.16 KB, patch
mrbkap
: review+
Details | Diff | Splinter Review 
On TM branch, post-Compartments-landing:

ASSERTION: bad outer object hook!: 'flat', 
file js/src/xpconnect/src/xpcconvert.cpp

Crash [@ js::gc::Cell::compartment]
blocking2.0: --- → ?
Attached file stack traces — 

    
  
Assignee: nobody → peterv
Status: NEW → ASSIGNED

    
  
blocking2.0: ? → beta7+

    
    

    
  

      
      
      
      

        Attached patch
          
          
        v1
        — 
          — Splinter Review
      

    


  
We need to make the inner window hold a strong reference to its outer.

    
  

        Attachment #482699 -
        Flags: review?(mrbkap)

    
    

    
  
Comment on attachment 482699 [details] [diff] [review]
v1

>@@ -1652,16 +1650,18 @@ nsGlobalWindow::SetNewDocument(nsIDocume
> 
>   if (IsFrozen()) {
>     // This outer is now getting its first inner, thaw the outer now
>     // that it's ready and is getting an inner window.
> 
>     Thaw();
>   }
> 
>+  // XXX Brain transplant outer window JSObject and create new one!

No need for this comment to come back.

        Attachment #482699 -
        Flags: review?(mrbkap) → review+

    
    

    
  
http://hg.mozilla.org/mozilla-central/rev/d468bf98f7a1
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED

    
  
Blocks: 580128
Crash Signature: [@ js::gc::Cell::compartment]

          You need to log in
          before you can comment on or make changes to this bug.