648206 - "ASSERTION: bad this object in get" or crash [@ xpc::holder_get] with InstallTrigger

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Jesse Ruderman]

Symptoms are exactly the same as old bug 608963:

Debug:

###!!! ASSERTION: bad this object in set: 'wrapper->isProxy()', file js/src/xpconnect/wrappers/XrayWrapper.cpp, line 207

Assertion failure: isProxy(), at jsproxy.h:193

Opt:

Crash bp-8c6523b2-2b06-4848-9cbb-089062110406 [@ xpc::holder_set ]

Filing as security-sensitive because InstallTrigger/wrappers is a sensitive area.

Comment 1

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Comment 2

[Jesse Ruderman]

Attachment: stack traces (mac debug)

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix v1

So, this is one fix for this bug. The other fix that I considered (albeit not for very long) was just to throw in this case. In other words, you wouldn't be allowed to use an Xray wrapper as the prototype of another object. I wasn't sure if there might be a use-case for that though, so I backed off.

Comment 4

[Andreas Gal :gal]

Comment on attachment 525190 [details] [diff] [review]
Proposed fix v1

Common out the code?

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/tracemonkey/rev/e0f9db5a4fc7

Comment 6

[Daniel Veditz [:dveditz]]

This appears to have been merged to mozilla-central and is currently on Aurora(6) but not Beta(5). That's probably a fine state to be in since it's internally discovered and old supported releases don't have Xray wrappers.

Taking a swag at a sg:critical rating.