Last Comment Bug 778409 - Compartment mismatch accessing during COW prototype remapping
: Compartment mismatch accessing during COW prototype remapping
Status: RESOLVED FIXED
[qa?]
: regression
Product: Core
Classification: Components
Component: XPConnect (show other bugs)
: unspecified
: All All
: -- normal (vote)
: mozilla17
Assigned To: Bobby Holley (:bholley) (busy with Stylo)
:
: Andrew Overholt [:overholt]
Mentors:
: 685965 778639 778742 778748 (view as bug list)
Depends on:
Blocks: 760109
  Show dependency treegraph
 
Reported: 2012-07-28 01:52 PDT by Bobby Holley (:bholley) (busy with Stylo)
Modified: 2012-08-25 02:27 PDT (History)
13 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
+
fixed
+
fixed
fixed
-
fixed


Attachments
Bug 778409 - Enter the compartment of unwrappedProto rather than obj in Rewrap. v1 (2.55 KB, patch)
2012-07-28 02:28 PDT, Bobby Holley (:bholley) (busy with Stylo)
mrbkap: review+
gkrizsanits: review+
Details | Diff | Splinter Review

Description Bobby Holley (:bholley) (busy with Stylo) 2012-07-28 01:52:11 PDT
From bug 760109 comment 44.
Comment 1 Bobby Holley (:bholley) (busy with Stylo) 2012-07-28 02:28:34 PDT
Created attachment 646829 [details] [diff] [review]
Bug 778409 - Enter the compartment of unwrappedProto rather than obj in Rewrap. v1

This can happen if chrome sets its proto to a content object from a different scope
than the one doing the wrapping. In this case, the prototype chain looks like this:

chromeobj => CCW(examplecom_obj) => CCW(examplecom_scope.Object.prototype)

When wrapping chromeobj for exampleorg_scope, things will look like this:

COW(chromeobj) => CCW(examplecom_obj) => CCW(examplecom_scope.Object.prototype)

Note that we don't remap the proto of CCW(examplecom_scope) to
exampleorg_scope.Object.prototype, because the proto remapping only happens when
the object we're wrapping is chrome. There's no reason it has to be this way, but
even if we changed it we still wouldn't get the nice remapped lookup behavior to
exampleorg_scope.Object.prototype, because the proxy handler for CCW(examplecom_obj)
isn't a ChromeObjectWrapper, and thus doesn't know how to to the prototype bouncing
correctly.

Anyway, I suspect this case isn't worth worrying about as long as we don't crash.
Comment 2 Bobby Holley (:bholley) (busy with Stylo) 2012-07-30 12:57:10 PDT
*** Bug 778742 has been marked as a duplicate of this bug. ***
Comment 3 Bobby Holley (:bholley) (busy with Stylo) 2012-07-30 12:59:04 PDT
*** Bug 778748 has been marked as a duplicate of this bug. ***
Comment 4 Bobby Holley (:bholley) (busy with Stylo) 2012-07-30 13:10:13 PDT
*** Bug 778639 has been marked as a duplicate of this bug. ***
Comment 5 Gabor Krizsanits [:krizsa :gabor] 2012-07-30 13:15:10 PDT
Comment on attachment 646829 [details] [diff] [review]
Bug 778409 - Enter the compartment of unwrappedProto rather than obj in Rewrap. v1

Review of attachment 646829 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good.
Comment 6 Bobby Holley (:bholley) (busy with Stylo) 2012-07-30 13:20:39 PDT
Pushed to m-i:
http://hg.mozilla.org/integration/mozilla-inbound/rev/a0fbc2a467eb
Comment 7 Ed Morley [:emorley] 2012-07-31 06:12:24 PDT
https://hg.mozilla.org/mozilla-central/rev/a0fbc2a467eb
Comment 8 [PTO to Dec5] Bill McCloskey (:billm) 2012-07-31 10:12:53 PDT
*** Bug 685965 has been marked as a duplicate of this bug. ***
Comment 9 Daniel Veditz [:dveditz] 2012-08-02 16:21:20 PDT
tracking 15 and 16 because bug 760109 is tracking those branches.
Comment 10 Bobby Holley (:bholley) (busy with Stylo) 2012-08-10 01:27:13 PDT
This got landed to branches over with the patches in bug 760109.
Comment 11 Lukas Blakk [:lsblakk] use ?needinfo 2012-08-16 16:42:14 PDT
Removing the ESR tracking here since this is being tracked for ESR10 over on bug 760109.
Comment 12 Bobby Holley (:bholley) (busy with Stylo) 2012-08-23 18:11:04 PDT
Pushed to esr10:
https://hg.mozilla.org/releases/mozilla-esr10/rev/e23789e6cea4
Comment 13 Ioana (away) 2012-08-25 02:27:56 PDT
Is there some way QA can verify this bug?

Note You need to log in before you can comment on or make changes to this bug.