604851 - Asserts about unknown wrapper types followed by crash

Status: RESOLVED DUPLICATE of bug 604368

(Core :: XPConnect, defect)

Description

[Boris Zbarsky [:bzbarsky]]

Attachment: gdb log

BUILD: Current m-c or TM build

STEPS TO REPRODUCE:
1)  Apply the patch from bug 602780
2)  Run the browser/components/feeds/test/ mochitests

EXPECTED RESULTS: pass the tests!

ACTUAL RESULTS:
###!!! ASSERTION: What kind of wrapper is this?: 'IS_WRAPPER_CLASS(obj->getClass())', file /Users/bzbarsky/mozilla/tracemonkey/mozilla/js/src/xpconnect/src/nsXPConnect.cpp, line 2438
###!!! ASSERTION: Forgot to check if this is a wrapper?: 'IS_WRAPPER_CLASS(obj->getClass())', file /Users/bzbarsky/mozilla/tracemonkey/mozilla/js/src/xpconnect/src/xpcprivate.h, line 1372
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: 13 at address: 0x0000000000000000
0x0000000100eb35f1 in XPCWrappedNativeScope::GetPrincipal (this=0x100959617) at xpcprivate.h:1465
1465             mScriptObjectPrincipal->GetPrincipal() : nsnull;}
(gdb) p mScriptObjectPrincipal
$4 = (Cannot access memory at address 0xbf010b9cb2358d48

and things are then all confused.

Attachment is a more extensive debugging log, with backtraces for the asserts, info on what the objects involved are, etc.  The short story is that the backtraces are what they are, and the objects are Sandbox.

Applying the patch for bug 604368 to m-c doesn't help (and again, this is reproducible on TM).

Comment 1

[Boris Zbarsky [:bzbarsky]]

Ah, the updated patch for bug 604368 might help.  I'll try to test that tomorrow.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Yeah, that makes things work.