825395 - Add checking for interleaved nsCxPusher and JSAutoEnterCompartment

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Bobby Holley (:bholley)]

nsCxPusher is manually initialized (via Push()) and can be manually destroyed (via Pop()), so it isn't guaranteed to follow RAII patterns. This means it can get interleaved with a JSAutoCompartment. This, in turn, hoses us if the call to Push() triggered a call to JS_SaveFrameChain, because that stashes the old compartment situation and leaves us as if we hadn't entered a compartment at all.

This just bit me, so I spent some time making sure it wouldn't happen again. Patch forthcoming.

Comment 1

[Bobby Holley (:bholley)]

Attachment: Add debug checking for interleaved nsCxPusher and JSAutoEnterCompartment. v1

Comment 2

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 696462 [details] [diff] [review]
Add debug checking for interleaved nsCxPusher and JSAutoEnterCompartment. v1

r=me, but you probably need a js peer review on the jsfriendapi bits.

Comment 3

[Bobby Holley (:bholley)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e194999b0d66

Comment 4

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/e194999b0d66