608862 - Compartment mismatch resolving prototypes

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Blake Kaplan (:mrbkap) (inactive)]

+++ This bug was initially created as a clone of Bug #602223 +++

bug 602223 fixed the crasher here, but with that fixed we still hit a bunch of compartment mismatches. The steps to reproduce (thanks Natch!) are:

1) Type javascript:this in the Web Console on the about:home page.
2) Click on the resulting [object Window]

This probably blocks 2.0 but not beta7.

Comment 1

[David Mandelin [:dmandelin]]

It might be good to have this block beta8 so any related crashes stop showing up in the topcrash lists.

Comment 2

[Francisco Camenforte Torres]

After solving bug 602223, it crashes for me now like this: http://crash-stats.mozilla.com/report/index/bp-65f3d7bc-26a8-44af-8797-f61cc2101103

Comment 3

[erpman1]

um, bug 602223 was "reopened" recently

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

I ended up fixing this compartment mismatch to make tinderbox go green a couple of nights ago: http://hg.mozilla.org/mozilla-central/rev/c7c2a896d323 the crash seen in comment 2 is going to be fixed by a combination of bug 609794 and bug 609626 (note that the crash should be fixed when the former lands).