Last Comment Bug 689128 - crash when calling nsIEventListenerService.getListenerInfoFor with null argument
: crash when calling nsIEventListenerService.getListenerInfoFor with null argument
Product: Core
Classification: Components
Component: Event Handling (show other bugs)
: Trunk
: x86_64 Linux
: -- normal (vote)
: mozilla9
Assigned To: Olli Pettay [:smaug]
: Andrew Overholt [:overholt]
Depends on:
  Show dependency treegraph
Reported: 2011-09-26 04:17 PDT by arno renevier
Modified: 2011-10-10 10:23 PDT (History)
5 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

WIP (9.80 KB, patch)
2011-10-09 06:43 PDT, Olli Pettay [:smaug]
no flags Details | Diff | Splinter Review
patch (18.16 KB, patch)
2011-10-09 09:13 PDT, Olli Pettay [:smaug]
bzbarsky: review+
Details | Diff | Splinter Review

Description arno renevier 2011-09-26 04:17:21 PDT
following code in chrome context crashes mozilla:
    Components.classes[";1"].getService(Ci.nsIEventListenerService).getListenerInfoFor(null, {})
Comment 1 Kyle Huey [:khuey] (Exited; not receiving bugmail, email if necessary) 2011-09-26 09:02:10 PDT
Yeah ... don't do that ;-)
Comment 2 Boris Zbarsky [:bz] (still a bit busy) 2011-09-26 10:15:13 PDT
Or we could NS_ENSURE_ARG_POINTER and be done with it.  Might be worth it....
Comment 3 Olli Pettay [:smaug] 2011-10-09 05:56:26 PDT
Not so fun; bug 587698 disabled *all* our event listener service tests, and now
even those ones not using JSD fail because of compartment mismatch, and once that problem is fixed
there is an assertion I don't quite understand yet...
Comment 4 Olli Pettay [:smaug] 2011-10-09 06:43:41 PDT
Created attachment 565801 [details] [diff] [review]

but getEventTargetChainFor call causes still 
###!!! ASSERTION: Non-global object has the wrong flags: '!(jsclazz->flags & JSCLASS_IS_GLOBAL)', file /home/smaug/mozilla/hg/m-c/js/src/xpconnect/src/xpcwrappednative.cpp, line 1146
XPCWrappedNative::Init(XPCCallContext&, JSObject*, int, XPCNativeScriptableCreateInfo const*) (/home/smaug/mozilla/hg/m-c/js/src/xpconnect/src/xpcwrappednative.cpp:1145)
Comment 5 Olli Pettay [:smaug] 2011-10-09 07:02:55 PDT
So the assertion happens somehow when page's JS touches TabChildGlobal.

I wonder what has changed since bug 587698 to cause that assertion to fire.
(The assertion has been there for a long time)
Comment 6 Olli Pettay [:smaug] 2011-10-09 08:01:03 PDT is in the stack..
Comment 7 Olli Pettay [:smaug] 2011-10-09 09:03:06 PDT
Ok, found the problem, patch coming.
Comment 8 Olli Pettay [:smaug] 2011-10-09 09:13:01 PDT
Created attachment 565809 [details] [diff] [review]

The patch has sort of random stuff that is needed to be able to run the
tests again without errors or assertions.
Comment 9 Boris Zbarsky [:bz] (still a bit busy) 2011-10-09 19:39:20 PDT
Comment on attachment 565809 [details] [diff] [review]

Comment 10 Olli Pettay [:smaug] 2011-10-10 10:23:07 PDT

Note You need to log in before you can comment on or make changes to this bug.