"Assertion failure: win" in nsWindowSH::GlobalScopePolluterNewResolve

RESOLVED FIXED

Status

()

Core
DOM
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Unassigned)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
x86_64
Mac OS X
assertion, crash, regression, testcase
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox21 unaffected, firefox22+ fixed)

Details

(crash signature)

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 725831 [details]
testcase

Assertion failure: win, at /Users/jruderman/trees/mozilla-central/dom/base/nsDOMClassInfo.cpp:3705

I'm guessing it would crash on the next line in a non-debug build.
[@ nsWindowSH::GlobalScopePolluterNewResolve]

This is a regression from today's merge from inbound.  I'm guessing bug 850517.
http://hg.mozilla.org/mozilla-central/pushloghtml?changeset=0b052daa913c
(Reporter)

Comment 1

5 years ago
Created attachment 725832 [details]
stack
Duplicate of this bug: 851887
This is the #1 topcrasher on nightly, and the fix is trivial, so I'm checking it in directly to m-c.

I massaged the testcase here for a while, but couldn't get it to work as a crashtest. Cutting my losses for now and pushing:

https://hg.mozilla.org/mozilla-central/rev/b03bb3ce8cee
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
This is another reason getting the window from the document is wrong, imo...

Updated

5 years ago
Crash Signature: [@ nsWindowSH::GlobalScopePolluterNewResolve(JSContext*, JS::Handle<JSObject*>, JS::Handle<int>, unsigned int, JS::MutableHandle<JSObject*>)]

Updated

5 years ago
status-firefox21: --- → unaffected
status-firefox22: --- → fixed
tracking-firefox22: --- → +
You need to log in before you can comment on or make changes to this bug.