Closed Bug 822691 Opened 8 years ago Closed 8 years ago

"ABORT: wrong compartment" with setUserData on node whose __proto__ is from a different frame

Categories

(Core :: XPConnect, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla20
Tracking Status
firefox19 --- unaffected
firefox20 + fixed
firefox-esr17 --- unaffected
b2g18 --- unaffected

People

(Reporter: jruderman, Assigned: bzbarsky)

References

Details

(4 keywords, Whiteboard: [adv-main20-])

Attachments

(3 files)

###!!! ABORT: wrong compartment: 'js::IsObjectInContextCompartment(scope, mJSContext)', file XPCInlines.h, line 110

(Related to bug 764307 / bug 645560?)

(I hope settable __proto__ isn't being standardized.)
Attached file stack
699   JS::Value result;
700   aError = nsContentUtils::XPConnect()->VariantToJS(aCx, GetWrapper(), oldData,
701                                                     &result);

So the key is that aCx comes in on the compartment of the proto, since that's where the method was found.  But GetWrapper() is in a different compartment....

We should be entering the compartment of GetWrapper() here, I think.  Sorry I missed that when reviewing.  :(

GetUserData has the same problem, afaict.

The good news is that I think this is trunk-only, since bug 812333 is Firefox 20 only.
Blocks: 812333
Oh, and I would think that doing get/setUserData via Xrays would have the same problem.
Boris, who can we assign this to?
Assignee: nobody → bzbarsky
Whiteboard: [need review]
Attachment #695981 - Flags: review?(bugs) → review+
Depends on: 825025
This patch on its own fails tests because of bug 825025.  So I'll need to land that first.
https://hg.mozilla.org/integration/mozilla-inbound/rev/2618c84dd765
Flags: in-testsuite+
Whiteboard: [need review]
Target Milestone: --- → mozilla20
https://hg.mozilla.org/mozilla-central/rev/2618c84dd765
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Whiteboard: [adv-main20-]
Group: core-security
You need to log in before you can comment on or make changes to this bug.