772215 - Crash with multiple compartments, nodeList, trickster proxy

Status: RESOLVED DUPLICATE of bug 767273

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Loading the testcase causes a crash [@ JSCompartment::wrap] or
Assertion failure: (ptrBits & 0x7) == 0, at jsval.h:700

This is the same kind of "trickster proxy" as in bug 767273, which has a shell testcase.  It might be the same bug.

Comment 1

[Jesse Ruderman]

Attachment: stack trace (assertion)

Comment 2

[Jesse Ruderman]

Attachment: stack trace (crash)

Comment 3

[Bobby Holley (:bholley)]

When I load the testcase on osx64, I get:

JavaScript error: file:///Users/bholley/Desktop/tp.html, line 16: TypeError: can't convert null to primitive type

No crash. I'm betting my fix over in bug 767273 will fix this though.

Comment 4

[Jesse Ruderman]

Hmm, I can reproduce using a debug build I downloaded from Tinderbox, but not with a local debug build.

Comment 5

[Andrew McCreight [:mccr8]]

Attachment: API init

This is definitely a dupe of bug 767273.  Here's a minimal fix for this particular entryway.  With badInit (and actually, without it on my particular build) the testcase here crashes.  With init, it doesn't crash.

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 767273).