603531 - "ASSERTION: bad outer object hook" and crash [@ js::gc::Cell::compartment]

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

On TM branch, post-Compartments-landing:

ASSERTION: bad outer object hook!: 'flat', 
file js/src/xpconnect/src/xpcconvert.cpp

Crash [@ js::gc::Cell::compartment]

Comment 1

[Jesse Ruderman]

Attachment: stack traces

Comment 2

[Peter Van der Beken [:peterv]]

Attachment: v1

We need to make the inner window hold a strong reference to its outer.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 482699 [details] [diff] [review]
v1

>@@ -1652,16 +1650,18 @@ nsGlobalWindow::SetNewDocument(nsIDocume
> 
>   if (IsFrozen()) {
>     // This outer is now getting its first inner, thaw the outer now
>     // that it's ready and is getting an inner window.
> 
>     Thaw();
>   }
> 
>+  // XXX Brain transplant outer window JSObject and create new one!

No need for this comment to come back.

Comment 4

[Peter Van der Beken [:peterv]]

http://hg.mozilla.org/tracemonkey/rev/d468bf98f7a1
http://hg.mozilla.org/tracemonkey/rev/612e2a9ca9ee

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/d468bf98f7a1