862092 - "Assertion failure: target->isNative() == obj->isNative()" adopting a <select>

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

Attachment: testcase (asserts fatally when loaded)

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Boris Zbarsky [:bzbarsky]]

Well, this is exciting.

The assert is:

  JS_ASSERT(target->isNative() == obj->isNative());

In this case target->getClass() == &js::Objectclass, but obj is a proxy whose proxy is, not surprisingly, mozilla::dom::HTMLSelectElementBinding::DOMProxyHandler.

Comment 3

[Boris Zbarsky [:bzbarsky]]

So ReparentWrapper uses a vanilla object to hold the properties from aObj and then put them back on the new aObj.

But in this case aObj is a proxy, and JS_CopyPropertiesFrom can't copy from a proxy to a non-proxy, I guess.  Should we be copying from the expando object for the proxy case?

Do we have any other DOM proxies that can come through this code?

Comment 4

[Peter Van der Beken [:peterv]]

Yeah, we were not supposed to have proxies for nodes yet, reparenting is broken there.

Comment 5

[Peter Van der Beken [:peterv]]

Attachment: v1

Extracted from the HTMLDocument patch.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 738126 [details] [diff] [review]
v1

r=me

Comment 7

[Peter Van der Beken [:peterv]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/409285b3f69c

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Backed out for mochitest-2 failures.
https://hg.mozilla.org/integration/mozilla-inbound/rev/897654df47b6

https://tbpl.mozilla.org/php/getParsedLog.php?id=21915174&tree=Mozilla-Inbound

08:41:31     INFO -  1199 INFO TEST-START | /tests/dom/bindings/test/test_traceProtos.html
08:41:32  WARNING -  TEST-UNEXPECTED-FAIL | /tests/dom/bindings/test/test_traceProtos.html | Exited with code 11 during test run
08:41:32     INFO -  INFO | automation.py | Application ran for: 0:01:36.688397
08:41:32     INFO -  INFO | zombiecheck | Reading PID log: /tmp/tmpRlJegTpidlog
08:41:32     INFO -  mozcrash INFO | Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-linux64/1366211287/firefox-23.0a1.en-US.linux-x86_64.crashreporter-symbols.zip
08:41:32     INFO -  Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-linux64/1366211287/firefox-23.0a1.en-US.linux-x86_64.crashreporter-symbols.zip
08:41:57  WARNING -  PROCESS-CRASH | /tests/dom/bindings/test/test_traceProtos.html | application crashed [@ CanonicalizeXPCOMParticipant]
08:41:57     INFO -  Crash dump filename: /tmp/tmp5AJXkg/minidumps/713c4995-e4ae-c6e8-00b5067f-2e39d0fd.dmp
08:41:57     INFO -  Operating system: Linux
08:41:57     INFO -                    0.0.0 Linux 3.2.0-23-generic #36-Ubuntu SMP Tue Apr 10 20:39:51 UTC 2012 x86_64
08:41:57     INFO -  CPU: amd64
08:41:57     INFO -       family 6 model 45 stepping 7
08:41:57     INFO -       1 CPU
08:41:57     INFO -  Crash reason:  SIGSEGV
08:41:57     INFO -  Crash address: 0x0
08:41:57     INFO -  Thread 0 (crashed)
08:41:57     INFO -   0  libxul.so!CanonicalizeXPCOMParticipant [nsCycleCollector.cpp:409285b3f69c : 622 + 0x0]
08:41:57     INFO -      rbx = 0x00007fffbabc8ab0   r12 = 0x00007fffbabc8ab0
08:41:57     INFO -      r13 = 0x00007fffbabc8940   r14 = 0x00007fffffffffff
08:41:57     INFO -      r15 = 0xfffb7fffffffffff   rip = 0x00007f05895fe4b5
08:41:57     INFO -      rsp = 0x00007fffbabc88f0   rbp = 0x00007fffbabc8900
08:41:57     INFO -      Found by: given as instruction pointer in context
08:41:57     INFO -   1  libxul.so!WrappedNativeProtoShutdownEnumerator [XPCWrappedNativeScope.cpp:409285b3f69c : 633 + 0x8]
08:41:57     INFO -      rip = 0x00007f05890cabd9   rsp = 0x00007fffbabc88f8
08:41:57     INFO -      rbp = 0x00007fffbabc8900
08:41:57     INFO -      Found by: stack scanning
08:41:57     INFO -   2  libxul.so!GCGraphBuilder::NoteXPCOMRoot(nsISupports*) [nsCycleCollector.cpp:409285b3f69c : 1862 + 0x4]
08:41:57     INFO -      rip = 0x00007f05895ffdac   rsp = 0x00007fffbabc8910
08:41:57     INFO -      rbp = 0x00007fffbabc8930
08:41:57     INFO -      Found by: stack scanning
08:41:57     INFO -   3  libxul.so!XPCWrappedNativeScope::SuspectAllWrappers(XPCJSRuntime*, nsCycleCollectionTraversalCallback&) [XPCWrappedNativeScope.cpp:409285b3f69c : 433 + 0xc]
08:41:57     INFO -      rip = 0x00007f05890cb934   rsp = 0x00007fffbabc8940
08:41:57     INFO -      rbp = 0x00007fffbabc8990
08:41:57     INFO -      Found by: stack scanning

Comment 9

[Peter Van der Beken [:peterv]]

Hmm, I probably need to clear the expando object first, otherwise EnsureExpandoObject just returns the existing object :-/.

Comment 10

[Peter Van der Beken [:peterv]]

Attachment: Clear the exando object before cloning

Comment 11

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 739027 [details] [diff] [review]
Clear the exando object before cloning

r=me

Comment 12

[Peter Van der Beken [:peterv]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f5ba9622f687

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/f5ba9622f687