650275 - "ABORT: bad scope for new JSObjects" with setTimeout

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[moz_bug_r_a4]

Attachment: testcase (crashes Firefox when loaded)

###!!! ABORT: bad scope for new JSObjects: 'type.IsArithmetic() || cx->compartment == lccx.GetScopeForNewJSObjects()->compartment()', file js/src/xpconnect/src/xpcconvert.cpp, line 253

Comment 1

[Daniel Veditz [:dveditz]]

Doesn't look like a chemspill bug and we're not planning any more 4.0.x releases.

Comment 2

[Sheila Mooney]

Is this something we should be tracking for FF5? We are skipping these in the Aurora triage meetings and deferring the decision to the crit smash team. Can someone make a call on +/- here?

Comment 3

[Johnny Stenback (:jst)]

Tracking this for 5. Blake has a fix in the works.

Comment 4

[Sheila Mooney]

Blake, do you have a status? When do we expect a fix to be ready?

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

I have a patch that works but breaks a mochitest. I'm not sure how important the test is, though. I'll try to figure it out tomorrow.

Comment 6

[Asa Dotzler [:asa]]

We're now quite late in the game for Firefox 5. Does the fix at bug 650273 remedy this?

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

Yes, it does.

Comment 8

[Daniel Veditz [:dveditz]]

bug 650273 is fixed on mozilla-central

Comment 9

[Johnny Stenback (:jst)]

Per discussion with mrbkap and dveditz we've decided that it's too late to fix this for 5, but it's already fixed for 6.