769464 - getComputedStyle(worker) crashes

Status: VERIFIED FIXED

(Core :: XPConnect, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Jesse Ruderman]

Nightly: bp-d87ff006-17f0-4e0e-95ac-b81122120628

Comment 3

[Boris Zbarsky [:bzbarsky]]

Oops.  castNative has:

        if (dom::IsDOMClass(clasp)) {
            native = dom::UnwrapDOMObject<nsISupports>(cur);
            entries = nsnull;

which is bogus: it needs to make sure that the native is isupports!

Peter, do you want to patch, or should I?  I seem to recall you having some helpers for checking the isupports thing around....

Comment 4

[Boris Zbarsky [:bzbarsky]]

This is a regression from bug 760131.

Comment 5

[Peter Van der Beken [:peterv]]

Attachment: v1

Comment 6

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 641566 [details] [diff] [review]
v1

r=me.  First binding crashtest.  *sniff*

Comment 7

[Peter Van der Beken [:peterv]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/29104ecddc3a

Comment 8

[Peter Van der Beken [:peterv]]

Comment on attachment 641566 [details] [diff] [review]
v1

[Approval Request Comment]
Bug caused by (feature/regressing bug #): bug 760131
User impact if declined: crashes
Testing completed (on m-c, etc.): landed on mozilla-inbound, has crashtest
Risk to taking this patch (and alternatives if risky): low risk
String or UUID changes made by this patch: none

Comment 9

[Ed Morley [:emorley]]

This is asserting on OS X roughly half the time. Backed out since otherwise we would have to delay the inbound merge even longer today:
https://tbpl.mozilla.org/php/getParsedLog.php?id=13576427&tree=Mozilla-Inbound
https://tbpl.mozilla.org/php/getParsedLog.php?id=13577693&tree=Mozilla-Inbound

https://hg.mozilla.org/integration/mozilla-inbound/rev/50448898a28f

Comment 10

[Peter Van der Beken [:peterv]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0030a8043e4a

Comment 11

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/0030a8043e4a

Comment 12

[Alex Keybl [:akeybl]]

Comment on attachment 641566 [details] [diff] [review]
v1

[Triage Comment]
Low-risk, sg:crit fix for a regression in FF16. Approved for Aurora 16.

Comment 13

[Peter Van der Beken [:peterv]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/943b896fc721

Comment 14

[Matt Wobensmith [:mwobensmith][:matt:]]

Confirmed crash on build 2012-6-28, nightly
Verified fixed on build 2012-9-30, release
Verified fixed on build 2012-11-13, 17.0b6