898939 - "Assertion failure: !js::IsCrossCompartmentWrapper(obj)" adopting marquee

Status: RESOLVED FIXED

(Core :: XBL, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Assertion failure: !js::IsCrossCompartmentWrapper(obj), at js/xpconnect/wrappers/XrayWrapper.cpp:1281

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Bobby Holley (:bholley)]

Attachment: Bonus Fix - Flip custom scope automtion prefs for 449149-1{a,b}.html. v1

I noticed this while making the crashtest here.

This was done before we flipped the default to make reftests always run with
dom.use_xbl_scopes_for_remote_xul=false (see reftest-cmdline.js). So to get
the full test coverage we're looking for here, we need to force the opposite
pref.

Comment 3

[Bobby Holley (:bholley)]

Attachment: Loosen assertion. v1

This is just an overzealous assertion, rather than a security issue. But Jesse's
testcase here has interesting implications - it runs XBL code that uses
setTimeout, and then adopts the bound node into another compartment, which
rejiggers its prototype chain to correspond to a new XBL scope. I think we
should handle this all well, but I want to give Boris a chance to brainstorm
potential issues before opening this bug up.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 782670 [details] [diff] [review]
Bonus Fix - Flip custom scope automtion prefs for 449149-1{a,b}.html. v1

>automtion

automation.

r=me

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 782676 [details] [diff] [review]
Loosen assertion. v1

r=me

Comment 6

[Bobby Holley (:bholley)]

I think we agree at this point that this isn't a security issue.

Comment 7

[Bobby Holley (:bholley)]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/6cfe97defc64
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/be1be387ce59
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/d41299f47cb0

Comment 8

[Bobby Holley (:bholley)]

So, the reftest harness borks because it doesn't recognize the pref (which is in all.js). jgriffin says we could fix this by adding the pref to http://mxr.mozilla.org/mozilla-central/source/layout/tools/reftest/bootstrap.js, but it's probably easier to just disable the test on android.

https://hg.mozilla.org/integration/mozilla-inbound/rev/33c659c7b3b0

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/6cfe97defc64
https://hg.mozilla.org/mozilla-central/rev/be1be387ce59
https://hg.mozilla.org/mozilla-central/rev/d41299f47cb0
https://hg.mozilla.org/mozilla-central/rev/33c659c7b3b0