Closed Bug 1291437 Opened 8 years ago Closed 8 years ago

PostMessageEvent::Run should not be working with gray window objects

Categories

(Core :: DOM: Core & HTML, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla51
Tracking Status
firefox50 --- fixed
firefox51 --- fixed

People

(Reporter: bzbarsky, Assigned: bzbarsky)

References

Details

Attachments

(1 file)

This got hit in dom/media/test/test_access_control.html
Attachment #8777071 - Flags: review?(bugs) → review+
Pushed by bzbarsky@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/73a57814a495 Don't enter the compartment of a possibly-gray window object in PostMessageEvent::Run. r=smaug
Pushed by bzbarsky@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/d362c6cc036a followup. Add some comments explaining why we're initializing the AutoJSAPI in PostMessageEvent::Run the way we do. DONTBUILD
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla51
Comment on attachment 8777071 [details] [diff] [review] Don't enter the compartment of a possibly-gray window object in PostMessageEvent::Run Approval Request Comment [Feature/regressing bug #]: None [User impact if declined]: Possible GC crashes and other such badness [Describe test coverage new/current, TreeHerder]: This codepath is tested in general, yes. [Risks and why]: This is extremely low risk. [String/UUID change made/needed]: None.
Attachment #8777071 - Flags: approval-mozilla-aurora?
Comment on attachment 8777071 [details] [diff] [review] Don't enter the compartment of a possibly-gray window object in PostMessageEvent::Run Crash fix, has stabilized on Nightly for a few weeks, Aurora50+
Attachment #8777071 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: