Closed Bug 862092 Opened 8 years ago Closed 8 years ago

"Assertion failure: target->isNative() == obj->isNative()" adopting a <select>

Categories

(Core :: DOM: Core & HTML, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla23

People

(Reporter: jruderman, Assigned: peterv)

References

Details

(Keywords: regression, testcase)

Attachments

(4 files)

No description provided.
Attached file stack
Well, this is exciting.

The assert is:

  JS_ASSERT(target->isNative() == obj->isNative());

In this case target->getClass() == &js::Objectclass, but obj is a proxy whose proxy is, not surprisingly, mozilla::dom::HTMLSelectElementBinding::DOMProxyHandler.
So ReparentWrapper uses a vanilla object to hold the properties from aObj and then put them back on the new aObj.

But in this case aObj is a proxy, and JS_CopyPropertiesFrom can't copy from a proxy to a non-proxy, I guess.  Should we be copying from the expando object for the proxy case?

Do we have any other DOM proxies that can come through this code?
Blocks: 841488
Flags: needinfo?(peterv)
Yeah, we were not supposed to have proxies for nodes yet, reparenting is broken there.
Assignee: nobody → peterv
Flags: needinfo?(peterv)
Attached patch v1Splinter Review
Extracted from the HTMLDocument patch.
Attachment #738126 - Flags: review?(bzbarsky)
Comment on attachment 738126 [details] [diff] [review]
v1

r=me
Attachment #738126 - Flags: review?(bzbarsky) → review+
Backed out for mochitest-2 failures.
https://hg.mozilla.org/integration/mozilla-inbound/rev/897654df47b6

https://tbpl.mozilla.org/php/getParsedLog.php?id=21915174&tree=Mozilla-Inbound

08:41:31     INFO -  1199 INFO TEST-START | /tests/dom/bindings/test/test_traceProtos.html
08:41:32  WARNING -  TEST-UNEXPECTED-FAIL | /tests/dom/bindings/test/test_traceProtos.html | Exited with code 11 during test run
08:41:32     INFO -  INFO | automation.py | Application ran for: 0:01:36.688397
08:41:32     INFO -  INFO | zombiecheck | Reading PID log: /tmp/tmpRlJegTpidlog
08:41:32     INFO -  mozcrash INFO | Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-linux64/1366211287/firefox-23.0a1.en-US.linux-x86_64.crashreporter-symbols.zip
08:41:32     INFO -  Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-linux64/1366211287/firefox-23.0a1.en-US.linux-x86_64.crashreporter-symbols.zip
08:41:57  WARNING -  PROCESS-CRASH | /tests/dom/bindings/test/test_traceProtos.html | application crashed [@ CanonicalizeXPCOMParticipant]
08:41:57     INFO -  Crash dump filename: /tmp/tmp5AJXkg/minidumps/713c4995-e4ae-c6e8-00b5067f-2e39d0fd.dmp
08:41:57     INFO -  Operating system: Linux
08:41:57     INFO -                    0.0.0 Linux 3.2.0-23-generic #36-Ubuntu SMP Tue Apr 10 20:39:51 UTC 2012 x86_64
08:41:57     INFO -  CPU: amd64
08:41:57     INFO -       family 6 model 45 stepping 7
08:41:57     INFO -       1 CPU
08:41:57     INFO -  Crash reason:  SIGSEGV
08:41:57     INFO -  Crash address: 0x0
08:41:57     INFO -  Thread 0 (crashed)
08:41:57     INFO -   0  libxul.so!CanonicalizeXPCOMParticipant [nsCycleCollector.cpp:409285b3f69c : 622 + 0x0]
08:41:57     INFO -      rbx = 0x00007fffbabc8ab0   r12 = 0x00007fffbabc8ab0
08:41:57     INFO -      r13 = 0x00007fffbabc8940   r14 = 0x00007fffffffffff
08:41:57     INFO -      r15 = 0xfffb7fffffffffff   rip = 0x00007f05895fe4b5
08:41:57     INFO -      rsp = 0x00007fffbabc88f0   rbp = 0x00007fffbabc8900
08:41:57     INFO -      Found by: given as instruction pointer in context
08:41:57     INFO -   1  libxul.so!WrappedNativeProtoShutdownEnumerator [XPCWrappedNativeScope.cpp:409285b3f69c : 633 + 0x8]
08:41:57     INFO -      rip = 0x00007f05890cabd9   rsp = 0x00007fffbabc88f8
08:41:57     INFO -      rbp = 0x00007fffbabc8900
08:41:57     INFO -      Found by: stack scanning
08:41:57     INFO -   2  libxul.so!GCGraphBuilder::NoteXPCOMRoot(nsISupports*) [nsCycleCollector.cpp:409285b3f69c : 1862 + 0x4]
08:41:57     INFO -      rip = 0x00007f05895ffdac   rsp = 0x00007fffbabc8910
08:41:57     INFO -      rbp = 0x00007fffbabc8930
08:41:57     INFO -      Found by: stack scanning
08:41:57     INFO -   3  libxul.so!XPCWrappedNativeScope::SuspectAllWrappers(XPCJSRuntime*, nsCycleCollectionTraversalCallback&) [XPCWrappedNativeScope.cpp:409285b3f69c : 433 + 0xc]
08:41:57     INFO -      rip = 0x00007f05890cb934   rsp = 0x00007fffbabc8940
08:41:57     INFO -      rbp = 0x00007fffbabc8990
08:41:57     INFO -      Found by: stack scanning
Hmm, I probably need to clear the expando object first, otherwise EnsureExpandoObject just returns the existing object :-/.
Attachment #739027 - Flags: review?(bzbarsky)
Comment on attachment 739027 [details] [diff] [review]
Clear the exando object before cloning

r=me
Attachment #739027 - Flags: review?(bzbarsky) → review+
https://hg.mozilla.org/mozilla-central/rev/f5ba9622f687
Status: NEW → RESOLVED
Closed: 8 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.