608963 - "ASSERTION: bad this object in get" crash [@ xpc::holder_get ]

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Jesse Ruderman]

Attachment: testcase (asserts fatally when loaded)

###!!! ASSERTION: bad this object in get: 'wrapper->isProxy()', file js/src/xpconnect/wrappers/XrayWrapper.cpp, line 158

Assertion failure: isProxy(), at jsproxy.h:188

This is a regression from mrbkap's landings last night.

Comment 1

[Jesse Ruderman]

Attachment: stack traces

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

ray wrappers don't really support arbitrary getters and setters, so delegating to one should not pass the original object through, but instead use the wrapper. This is congruous to the while loop in XPC_NW_GetOrSetProperty in the olden days.

Comment 3

[Andreas Gal :gal]

Comment on attachment 487634 [details] [diff] [review]
Fix

Weird. This is pretty hacky.

Comment 4

[Andreas Gal :gal]

Does b7 need this or is b8 good enough?

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Given that this actually crashes in opt builds (and it's a regression from yesterday), b7 would be nice. But I don't think this is going to hit on any real sites or extensions, so b8 would be OK too.

Comment 6

[Johnny Stenback (:jst)]

Blocking beta7, but if this was the last and only bug and we didn't have a patch I'd punt. So land this ASAP :)

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/4e04ac0b0820