Closed
Bug 1291437
Opened 8 years ago
Closed 8 years ago
PostMessageEvent::Run should not be working with gray window objects
Categories
(Core :: DOM: Core & HTML, defect)
Core
DOM: Core & HTML
Tracking
()
RESOLVED
FIXED
mozilla51
People
(Reporter: bzbarsky, Assigned: bzbarsky)
References
Details
Attachments
(1 file)
(deleted),
patch
|
smaug
:
review+
ritu
:
approval-mozilla-aurora+
|
Details | Diff | Splinter Review |
This got hit in dom/media/test/test_access_control.html
Assignee | ||
Comment 1•8 years ago
|
||
Attachment #8777071 -
Flags: review?(bugs)
Updated•8 years ago
|
Attachment #8777071 -
Flags: review?(bugs) → review+
Pushed by bzbarsky@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/73a57814a495
Don't enter the compartment of a possibly-gray window object in PostMessageEvent::Run. r=smaug
Pushed by bzbarsky@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/d362c6cc036a
followup. Add some comments explaining why we're initializing the AutoJSAPI in PostMessageEvent::Run the way we do. DONTBUILD
Comment 4•8 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/73a57814a495
https://hg.mozilla.org/mozilla-central/rev/d362c6cc036a
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla51
Assignee | ||
Comment 5•8 years ago
|
||
Comment on attachment 8777071 [details] [diff] [review]
Don't enter the compartment of a possibly-gray window object in PostMessageEvent::Run
Approval Request Comment
[Feature/regressing bug #]: None
[User impact if declined]: Possible GC crashes and other such badness
[Describe test coverage new/current, TreeHerder]: This codepath is tested in
general, yes.
[Risks and why]: This is extremely low risk.
[String/UUID change made/needed]: None.
Attachment #8777071 -
Flags: approval-mozilla-aurora?
status-firefox50:
--- → affected
Comment on attachment 8777071 [details] [diff] [review]
Don't enter the compartment of a possibly-gray window object in PostMessageEvent::Run
Crash fix, has stabilized on Nightly for a few weeks, Aurora50+
Attachment #8777071 -
Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Comment 7•8 years ago
|
||
bugherder uplift |
Updated•6 years ago
|
Component: DOM → DOM: Core & HTML
You need to log in
before you can comment on or make changes to this bug.
Description
•