869038 - Crash with iframe, contenteditable, GC

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

Attachment: testcase (requires extension for GC)

1. Install https://www.squarefree.com/extensions/domFuzzLite3.xpi
2. Load the testcase

Result: crash with this=0xdadadadadadadada within js::assertSameCompartment

Comment 1

[Jesse Ruderman]

Attachment: stack (gdb)

Comment 2

[Jesse Ruderman]

Crashes in non-debug ASan builds too, in a different place.

Comment 3

[Bobby Holley (:bholley)]

This looks related to Document bindings, which IIUC landed recently.

Comment 4

[Peter Van der Beken [:peterv]]

Doesn't crash for me.

Comment 5

[Peter Van der Beken [:peterv]]

Managed to get it to crash.

Comment 6

[Peter Van der Beken [:peterv]]

Attachment: v1

nsContentUtils::ReleaseWrapper unsets PreservingWrapper, so it needs to clear the expando.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 746635 [details] [diff] [review]
v1

r=me

Comment 8

[Peter Van der Beken [:peterv]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ef2134c93dae

Comment 9

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/ef2134c93dae

Comment 10

[Al Billings [:abillings - ex-MoCo]]

Is Firefox 22 and earlier unaffected?

Comment 11

[Peter Van der Beken [:peterv]]

Yes, bug 855971 was landed in 23.

Comment 12

[u279076]

Matt, can you take a look at this to verify for Firefox 23?

Comment 13

[Matt Wobensmith [:mwobensmith][:matt:]]

Confirmed crash on FF23, 2013-05-05
Confirmed fixed on FF23, 2013-06-14