Closed Bug 626262 Opened 13 years ago Closed 13 years ago

"ASSERTION: ownerDocument changed again after adopting!" with mutation event

Categories

(Core :: DOM: Core & HTML, defect)

x86
macOS
defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla5
Tracking Status
firefox5 --- fixed
blocking1.9.2 --- .18+
status1.9.2 --- .18-fixed
status1.9.1 --- .20-fixed

People

(Reporter: jruderman, Assigned: peterv)

References

Details

(Keywords: assertion, testcase, Whiteboard: [sg:high?] [qa-examined-192])

Attachments

(4 files, 1 obsolete file)

Attached file testcase
###!!! ASSERTION: ownerDocument changed again after adopting!: 'HasSameOwnerDoc(newContent) && doc == GetOwnerDoc()', file content/base/src/nsGenericElement.cpp, line 4066
Attached file stack trace
Peter?
Closing this. Having a node in one document with a different ownerDocument might lead to cross-origin information leaks?
Blocks: 418755
Group: core-security
Whiteboard: [sg:high?]
Attached patch v1 (obsolete) — Splinter Review
Needs some more testing.
Assignee: nobody → peterv
Status: NEW → ASSIGNED
Attached patch v1.1Splinter Review
Attachment #513082 - Attachment is obsolete: true
Attachment #517440 - Flags: review?(bzbarsky)
Comment on attachment 517440 [details] [diff] [review]
v1.1

r=me
Attachment #517440 - Flags: review?(bzbarsky) → review+
http://hg.mozilla.org/mozilla-central/rev/12ea0bd80e2e
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Attachment #517440 - Flags: approval1.9.2.18?
Attachment #517440 - Flags: approval1.9.1.20?
blocking1.9.2: --- → .18+
Target Milestone: --- → mozilla5
Comment on attachment 517440 [details] [diff] [review]
v1.1

Is this patch really going to work on the branches as-is?
Need an answer to comment 8 before we can approve.
Whiteboard: [sg:high?] → [sg:high?][need answer to comment 8 from peterv]
Attached patch v1.1 (branch)Splinter Review
Here's the patch merged to the 1.9.2 branch.
Attachment #533336 - Flags: approval1.9.2.18?
Attachment #533336 - Flags: approval1.9.1.20?
Attachment #517440 - Flags: approval1.9.2.18?
Attachment #517440 - Flags: approval1.9.1.20?
Comment on attachment 533336 [details] [diff] [review]
v1.1 (branch)

Approved for 1.9.2.18 and 1.9.1.20, a=dveditz for release-drivers
Attachment #533336 - Flags: approval1.9.2.18?
Attachment #533336 - Flags: approval1.9.2.18+
Attachment #533336 - Flags: approval1.9.1.20?
Attachment #533336 - Flags: approval1.9.1.20+
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/b86d93d36a78
Whiteboard: [sg:high?][need answer to comment 8 from peterv] → [sg:high?]
Whiteboard: [sg:high?] → [sg:high?] [qa-examined-192]
Group: core-security
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.