673503 - WaiveXrayAndWrap can create illegal objects

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Blake Kaplan (:mrbkap) (inactive)]

WrapperFactory::WaiveXrayAndWrap attempts to do (basically) .wrappedJSObject from C++. However, in the case where an object has a prototype from a different compartment, it creates proxies whose prototypes are from the different compartment. This could be one cause of the bugs that billm has been tracking down.

I originally though that this could cause the assertion under JSWrapper::Trace, however, I don't think that's correct anymore. So it's likely that there's another bug lurking here.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

This is the easiest fix I could find. I decided to leave the assertions in to catch other bugs of this type later.

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 547770 [details] [diff] [review]
Proposed fix

Review of attachment 547770 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks, Blake. This also makes me realize that there are some GC compartment assertions that are still disabled in release builds. That's why we don't have any crash reports for proto pointers.

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 547770 [details] [diff] [review]
Proposed fix

Sorry, forgot to +.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/integration/mozilla-inbound/rev/14e7c0070059

Comment 5

[Marco Bonardo [:mak]]

http://hg.mozilla.org/mozilla-central/rev/14e7c0070059