Closed Bug 778409 Opened 12 years ago Closed 12 years ago

Compartment mismatch accessing during COW prototype remapping

Categories

(Core :: XPConnect, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla17
Tracking Status
firefox15 + fixed
firefox16 + fixed
firefox17 --- fixed
firefox-esr10 - fixed

People

(Reporter: bholley, Assigned: bholley)

References

Details

(Keywords: regression, Whiteboard: [qa?])

Attachments

(1 file)

This can happen if chrome sets its proto to a content object from a different scope than the one doing the wrapping. In this case, the prototype chain looks like this: chromeobj => CCW(examplecom_obj) => CCW(examplecom_scope.Object.prototype) When wrapping chromeobj for exampleorg_scope, things will look like this: COW(chromeobj) => CCW(examplecom_obj) => CCW(examplecom_scope.Object.prototype) Note that we don't remap the proto of CCW(examplecom_scope) to exampleorg_scope.Object.prototype, because the proto remapping only happens when the object we're wrapping is chrome. There's no reason it has to be this way, but even if we changed it we still wouldn't get the nice remapped lookup behavior to exampleorg_scope.Object.prototype, because the proxy handler for CCW(examplecom_obj) isn't a ChromeObjectWrapper, and thus doesn't know how to to the prototype bouncing correctly. Anyway, I suspect this case isn't worth worrying about as long as we don't crash.
Attachment #646829 - Flags: review?(mrbkap)
Comment on attachment 646829 [details] [diff] [review] Bug 778409 - Enter the compartment of unwrappedProto rather than obj in Rewrap. v1 Review of attachment 646829 [details] [diff] [review]: ----------------------------------------------------------------- Looks good.
Attachment #646829 - Flags: review+
Attachment #646829 - Flags: review?(mrbkap) → review+
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla17
Keywords: regression
tracking 15 and 16 because bug 760109 is tracking those branches.
This got landed to branches over with the patches in bug 760109.
Removing the ESR tracking here since this is being tracked for ESR10 over on bug 760109.
Is there some way QA can verify this bug?
Whiteboard: [qa?]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: