696603 - "(new MozBlobBuilder).append(null);" crashes

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

###!!! ASSERTION: Er, what?: 'obj', file content/base/src/nsDOMBlobBuilder.cpp, line 375

###!!! ASSERTION: bad param: 'aJSObj', file js/xpconnect/src/nsXPConnect.cpp, line 1468

###!!! ASSERTION: bad param: 'obj', file js/xpconnect/src/XPCWrappedNative.cpp, line 1594

Crash [@ nsXPConnect::GetNativeOfWrapper]
  (Opt: bp-aa135286-3026-410b-a80d-c289a2111022)

Comment 1

[Jesse Ruderman]

Attachment: stacks

Comment 2

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Attachment: Patch

Comment 3

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

https://hg.mozilla.org/mozilla-central/rev/58eb2ebcc7d2

Comment 4

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Comment on attachment 569045 [details] [diff] [review]
Patch

This is a pretty simple fix.

Comment 5

[LegNeato]

---------------------------------[ Triage Comment ]---------------------------------

Though it is a simple fix, there were only 2 crashes in the last week across all versions so the reward side of the equation doesn't seem to be there. Let's let this come up through the normal process.

Comment 6

[Jesse Ruderman]

At least one of those crashes was me ;)