616989 - JS_ASSERT when calling loadSubScript from a sandbox

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Asaf Romano (gone)]

When loadSubScript is called from a sandbox, Executing the script asserts here:
http://hg.mozilla.org/mozilla-central/annotate/44641ad32c29/js/src/jsinterp.cpp#l960

To reproduce try entering the following code in the Javascript console:
var sandbox = Components.utils.Sandbox(window.top.opener);
sandbox.w = window.top.opener;
var codeStr = "Components.classes['@mozilla.org/moz/jssubscript-loader;1']." +
"getService(Components.interfaces.mozIJSSubScriptLoader)." +
"loadSubScript('chrome://global/content/globalOverlay.js', w);";
Components.utils.evalInSandbox(codeStr, sandbox);

On debug build it crashes. I'm almost sure this is a recent regression.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Possible fix

I don't really know what to do here. We have an Xray wrapper that's being used as the target for a subscript. It seems that the most obvious behavior is to unwrap it all the way (and then innerize), but it bothers me unwrapping it like this...

Comment 2

[Johnny Stenback (:jst)]

This regression triggers a fatal assertion, we need to fix this for 2.0, and I think we should take mrbkap's proposed fix.

Comment 3

[Johnny Stenback (:jst)]

Comment on attachment 495634 [details] [diff] [review]
Possible fix

I agree that this seems a bit like something we don't want to do, but given what we have to work with here I don't see a better way to deal with here.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/tracemonkey/rev/f010a983d577

Comment 5

[Mounir Lamouri (:mounir)]

Pushed:
https://hg.mozilla.org/mozilla-central/rev/43bdb3403733