Last Comment Bug 693250 - "ASSERTION: Wrong scope, this is really bad!" with document.write on vanished about:blank
: "ASSERTION: Wrong scope, this is really bad!" with document.write on vanished...
Status: VERIFIED FIXED
[sg:critical][qa+] fixed by 693399
: assertion, testcase
Product: Core
Classification: Components
Component: Document Navigation (show other bugs)
: Trunk
: x86_64 Mac OS X
: -- normal (vote)
: mozilla11
Assigned To: Henri Sivonen (:hsivonen) (Not doing reviews or reading bugmail until 2016-08-01)
:
Mentors:
Depends on: CVE-2012-0442
Blocks: 594645
  Show dependency treegraph
 
Reported: 2011-10-10 01:47 PDT by Jesse Ruderman
Modified: 2012-06-03 10:58 PDT (History)
14 users (show)
hsivonen: in‑testsuite?
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
-
wontfix
+
wontfix
+
verified
+
verified
10+
verified
.26+
.26-fixed


Attachments
testcase (419 bytes, text/html)
2011-10-10 01:47 PDT, Jesse Ruderman
no flags Details
stack trace (1.26 KB, text/plain)
2011-10-10 01:47 PDT, Jesse Ruderman
no flags Details

Description Jesse Ruderman 2011-10-10 01:47:08 PDT
Created attachment 565880 [details]
testcase

###!!! ASSERTION: Wrong scope, this is really bad!: 'JS_GetGlobalForObject(cx, obj) == newScope', file content/base/src/nsDocument.cpp, line 3811

In the testcase, |d| is a temporary "about:blank" document, even once |w.document| is the "data:text/html,2" document.
Comment 1 Jesse Ruderman 2011-10-10 01:47:29 PDT
Created attachment 565881 [details]
stack trace
Comment 2 Jesse Ruderman 2011-10-10 09:57:10 PDT
Can be followed by:

###!!! ASSERTION: Uh, mDocument doesn't match the current inner window document!: '!GetCurrentInnerWindow() || GetCurrentInnerWindow()->GetExtantDocument() == mDocument', file dom/base/nsGlobalWindow.cpp, line 1840
Comment 3 Boris Zbarsky [:bz] 2011-10-12 11:40:21 PDT
This is fundamentally the same setup as bug 693399.
Comment 4 Henri Sivonen (:hsivonen) (Not doing reviews or reading bugmail until 2016-08-01) 2011-11-14 23:42:55 PST
Bug 693399 landed. When it is made public, it would make sense to land the test case from this bug as a crashtest.
Comment 5 Daniel Veditz [:dveditz] 2011-11-17 13:12:15 PST
Should now be fixed on mozilla-central. Still leaving the bug open until the test lands (might as well, we have bug 693399 for the test)
Comment 6 Jesse Ruderman 2012-01-08 07:38:04 PST
> Still leaving the bug open until the test lands

Please don't do that. It breaks stats and after-fix.
Comment 7 Daniel Veditz [:dveditz] 2012-01-12 17:35:56 PST
This bug appears to affect 3.6.x
Comment 8 juan becerra [:juanb] 2012-03-12 18:27:14 PDT
Verified on recent Fx10 and Fx11 debug builds. Prior to the fix running the test case would show an assertion in the shell, but on the recent builds only a warning appears.
Comment 9 Al Billings [:abillings] 2012-03-14 15:54:12 PDT
Verified fixed in debug trunk.
Comment 10 Anthony Hughes (:ashughes) [GFX][QA][Mentor] 2012-06-03 10:58:41 PDT
Verified fixed in debug Firefox 10.0.5esrpre 2012-05-31.

Note You need to log in before you can comment on or make changes to this bug.