856849 - Poison nsGlobalWindow::mJSObject when it's finalized

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: patch

Blake filed bug 856818 to figure out what we can do if someone calls EnsureScriptEnvironment on a closed window. This bug is smaller in scope. It just tries to ensure that we crash reliably if the JS object for an outer window is finalized and we later try to access it.

Try link:
https://tbpl.mozilla.org/?tree=Try&rev=9e1d9a6341de

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 732099 [details] [diff] [review]
patch

This had *better* be green on try!

Comment 2

[Bobby Holley (:bholley)]

Wait, so PoisonGlobal operates only on outer windows, which are not globals? If I understand that correctly, I think we could improve the naming here :P

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

PoisonOuterWindowProxy?

Comment 4

[Bobby Holley (:bholley)]

(In reply to Bill McCloskey (:billm) from comment #3)
> PoisonOuterWindowProxy?

sgtm

Comment 5

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

And an assert there that it's only called on outer windows?

Comment 6

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/81d516cc6e36

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/81d516cc6e36