611401 - crash in [@ xpc_CreateSandboxObject]

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[David Dahl :ddahl]

Attachment: backtrace

attaching full backtrace.

here is the gist of it:

	mozjs.dll!JS_Assert(const char * s=0x60dcceb4, const char * file=0x60dcce84, int ln=211)  Line 73	C++
 	xul.dll!JSVAL_TO_OBJECT(jsval_layout v={...})  Line 211 + 0x2b bytes	C++
 	xul.dll!xpc_CreateSandboxObject(JSContext * cx=0x0400ab90, jsval_layout * vp=0x03b60dc8, nsISupports * prinOrSop=0x109598c0, JSObject * proto=0x0aece168, bool wantXrays=false)  Line 3247 + 0xd bytes	C++

Comment 1

[David Dahl :ddahl]

probably unrelated, but I had the patches from bug 568629 and bug 610714 applied, with the ConsoleAPI.manifest uncommented

Comment 2

[David Dahl :ddahl]

I just tried to reproduce this again and failed.

Comment 3

[timeless]

3242             if (xpc::WrapperFactory::IsXrayWrapper(proto) && !wantXrays) {
3243                 jsval v;
3244                 if (!JS_GetProperty(cx, proto, "wrappedJSObject", &v))
3245                     return NS_ERROR_XPC_UNEXPECTED;
3246 
3247                 proto = JSVAL_TO_OBJECT(v);

someone presumably set wrappedJSObject to a number or something :).

Comment 4

[timeless]

Attachment: proposal

Comment 5

[David Dahl :ddahl]

Attachment: Another backtrace

I was able to reproduce this crash. I opened the web console and typed document and inspected it by clicking on it. i loaded another page and as it was loading the debug in MSVC popped up.

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 490042 [details] [diff] [review]
proposal

proto is an Xray wrapper, wrappedJSObject can't be replaced.

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

This avoids the potential problem here by doing the unwrapping manually.

However, ddahl, I realized after our discussion on IRC that the reason this is failing is that we've decided that this window is cross-origin to the sandbox. Do you know why that would happen? Once this bug is fixed, I think that we'll see a bunch of stuff not work from the sandbox since the window is cross-origin and the sandbox won't be able to access most of the properties on it. You might want to open a separate bug on that.

Comment 8

[Rob Campbell [:rc] (:robcee)]

this looks like it has all the pieces to make it ready to land.

I tested the console with this patch applied and we pass all our tests.

Some informal testing revealed some weirdness with the results being returned from some types of dom queries though. They don't appear to be related to this patch.

Comment 9

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/tracemonkey/rev/3e97742e029a

Comment 10

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/3e97742e029a

Comment 11

[Blake Kaplan (:mrbkap) (inactive)]

This got backed out.

Comment 12

[Johnny Stenback (:jst)]

... but for reasons that had nothing to do with this bug. This patch needs to re-land.

Comment 13

[Mounir Lamouri (:mounir)]

Pushed:
https://hg.mozilla.org/mozilla-central/rev/09103345873c