Jesse Ruderman Reporter
	Description • 10 years ago

1. Create a profile
       with the prefs:
           user_pref("dom.min_background_timeout_value", 4);
           user_pref("dom.disable_open_during_load", false);
       and the extension:
           https://www.squarefree.com/extensions/domFuzzLite3.xpi

2. Run with the testcase filename on the command line
       (You might have to repeat step 2 a few times.)

###!!! ASSERTION: Inner window supports nsWrapperCache, fix WrapObject!: 'IsOuterWindow()', file dom/base/nsGlobalWindow.h, line 354
   (This assertion was added in bug 693301.)

###!!! ASSERTION: EnsureInnerWindow called on inner window: 'IsOuterWindow()', file dom/base/nsPIDOMWindow.h, line 331

	Peter Van der Beken [:peterv] Assignee
	Comment 2 • 10 years ago

We're firing the DOMContentLoaded event for "missing-1" (actually for the error page for that) but we've already collected the inner window for it.

	Peter Van der Beken [:peterv] Assignee
	Comment 3 • 10 years ago

The exact same thing happens with XPConnect reflectors for Window, but SetParentToWindow returns an error if the nsGlobalWindow doesn't have a wrapper anymore.

	Andrew McCreight [:mccr8]
	Comment 5 • 10 years ago

Please adjust the rating as appropriate.  I assume this is a regression from Window WebIDL.

	Boris Zbarsky [:bzbarsky]
	Comment 7 • 10 years ago

Comment on attachment 8435783 [details] [diff] [review]
v1

r=me

	Peter Van der Beken [:peterv] Assignee
	Comment 8 • 10 years ago

https://hg.mozilla.org/integration/mozilla-inbound/rev/4b7010671a27

	Ryan VanderMeulen [:RyanVM]
	Comment 9 • 10 years ago

https://hg.mozilla.org/mozilla-central/rev/4b7010671a27

	Peter Van der Beken [:peterv] Assignee
	Comment 10 • 10 years ago

Comment on attachment 8435783 [details] [diff] [review]
v1

Ugh, this missed the branching.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): bug 789261
User impact if declined: probably crashes/security issues
Testing completed (on m-c, etc.): landed on m-c
Risk to taking this patch (and alternatives if risky): low-risk, just makes us deal with a situation that we thought couldn't happen
String or IDL/UUID changes made by this patch: none

	Lawrence Mandel [:lmandel] (use needinfo)
	Comment 11 • 10 years ago

Comment on attachment 8435783 [details] [diff] [review]
v1

Aurora approval granted.

	Peter Van der Beken [:peterv] Assignee
	Comment 12 • 10 years ago

https://hg.mozilla.org/releases/mozilla-aurora/rev/9a12cabec2fe

	Matt Wobensmith [:mwobensmith][:matt:]
	Comment 13 • 10 years ago

Confirmed assert/crash on Fx32, 2014-05-30.
Verified fixed on Fx32, 2014-07-14.
Verified fixed on Fx33, 2014-07-07.