Last Comment Bug 689128 - crash when calling nsIEventListenerService.getListenerInfoFor with null argument
: crash when calling nsIEventListenerService.getListenerInfoFor with null argument
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: Event Handling (show other bugs)
: Trunk
: x86_64 Linux
: -- normal (vote)
: mozilla9
Assigned To: Olli Pettay [:smaug]
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2011-09-26 04:17 PDT by arno renevier
Modified: 2011-10-10 10:23 PDT (History)
5 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
WIP (9.80 KB, patch)
2011-10-09 06:43 PDT, Olli Pettay [:smaug]
no flags Details | Diff | Splinter Review
patch (18.16 KB, patch)
2011-10-09 09:13 PDT, Olli Pettay [:smaug]
bzbarsky: review+
Details | Diff | Splinter Review

Description arno renevier 2011-09-26 04:17:21 PDT
Hi,
following code in chrome context crashes mozilla:
    Components.classes["@mozilla.org/eventlistenerservice;1"].getService(Ci.nsIEventListenerService).getListenerInfoFor(null, {})
Comment 1 Kyle Huey [:khuey] (khuey@mozilla.com) 2011-09-26 09:02:10 PDT
Yeah ... don't do that ;-)
Comment 2 Boris Zbarsky [:bz] 2011-09-26 10:15:13 PDT
Or we could NS_ENSURE_ARG_POINTER and be done with it.  Might be worth it....
Comment 3 Olli Pettay [:smaug] 2011-10-09 05:56:26 PDT
Not so fun; bug 587698 disabled *all* our event listener service tests, and now
even those ones not using JSD fail because of compartment mismatch, and once that problem is fixed
there is an assertion I don't quite understand yet...
Comment 4 Olli Pettay [:smaug] 2011-10-09 06:43:41 PDT
Created attachment 565801 [details] [diff] [review]
WIP

but getEventTargetChainFor call causes still 
###!!! ASSERTION: Non-global object has the wrong flags: '!(jsclazz->flags & JSCLASS_IS_GLOBAL)', file /home/smaug/mozilla/hg/m-c/js/src/xpconnect/src/xpcwrappednative.cpp, line 1146
XPCWrappedNative::Init(XPCCallContext&, JSObject*, int, XPCNativeScriptableCreateInfo const*) (/home/smaug/mozilla/hg/m-c/js/src/xpconnect/src/xpcwrappednative.cpp:1145)
Comment 5 Olli Pettay [:smaug] 2011-10-09 07:02:55 PDT
So the assertion happens somehow when page's JS touches TabChildGlobal.

I wonder what has changed since bug 587698 to cause that assertion to fire.
(The assertion has been there for a long time)
Comment 6 Olli Pettay [:smaug] 2011-10-09 08:01:03 PDT
http://mxr.mozilla.org/mozilla-central/source/js/src/xpconnect/src/xpcconvert.cpp#486 is in the stack..
Comment 7 Olli Pettay [:smaug] 2011-10-09 09:03:06 PDT
Ok, found the problem, patch coming.
Comment 8 Olli Pettay [:smaug] 2011-10-09 09:13:01 PDT
Created attachment 565809 [details] [diff] [review]
patch

The patch has sort of random stuff that is needed to be able to run the
tests again without errors or assertions.
Comment 9 Boris Zbarsky [:bz] 2011-10-09 19:39:20 PDT
Comment on attachment 565809 [details] [diff] [review]
patch

r=me
Comment 10 Olli Pettay [:smaug] 2011-10-10 10:23:07 PDT
https://hg.mozilla.org/mozilla-central/rev/4c02f4104c17

Note You need to log in before you can comment on or make changes to this bug.