Closed
Bug 418776
Opened 17 years ago
Closed 17 years ago
Assertion failure: !OBJ_GET_PARENT(cx, obj), at mozilla/js/src/jsobj.c:2648
Categories
(Core :: XPConnect, defect, P2)
Tracking
()
VERIFIED
FIXED
People
(Reporter: kinetik, Assigned: jst)
References
Details
(Keywords: regression)
Attachments
(3 files)
(deleted),
text/html
|
Details | |
(deleted),
text/plain
|
Details | |
(deleted),
patch
|
mrbkap
:
review+
mrbkap
:
superreview+
|
Details | Diff | Splinter Review |
The attached testcase causes a fatal (in debug builds) assertion in the JS engine: !OBJ_GET_PARENT(cx, obj), at mozilla/js/src/jsobj.c:2648. I ran into this on a current trunk debug build while modifying a testcase based on the one in bug #313462 comment #13. Originally seen on a Mac build, but also reproduced on a few day old Linux build.
I'll add the complete backtrace as an attachment since backtraces aren't particularly readable when pasted into comments.
Reporter | ||
Comment 1•17 years ago
|
||
Comment 2•17 years ago
|
||
I don't crash with a debug build from this morning. Perhaps fixed by bug 418540 ?
Reporter | ||
Comment 3•17 years ago
|
||
I can still reproduce this. A key point I didn't realise earlier is that the testcase must be loaded via file:///.
Comment 4•17 years ago
|
||
confirmed, file:/// only crash. :-/
Comment 5•17 years ago
|
||
This looks more like a DOM bug to me.
Assignee: general → nobody
Component: JavaScript Engine → DOM
QA Contact: general → general
Comment 6•17 years ago
|
||
I get this any time I do alert(window.frames[0]) and that frame is cross-origin. I will lay bets this is XOW fallout. We should fix this.
Component: DOM → XPConnect
Flags: blocking1.9?
QA Contact: general → xpconnect
Assignee: nobody → jst
Blocks: xow
Flags: blocking1.9? → blocking1.9+
Keywords: regression
Priority: -- → P2
Assignee | ||
Comment 7•17 years ago
|
||
Attachment #310125 -
Flags: superreview?(mrbkap)
Attachment #310125 -
Flags: review?(mrbkap)
Updated•17 years ago
|
Attachment #310125 -
Flags: superreview?(mrbkap)
Attachment #310125 -
Flags: superreview+
Attachment #310125 -
Flags: review?(mrbkap)
Attachment #310125 -
Flags: review+
Assignee | ||
Comment 8•17 years ago
|
||
Fixed.
Assignee | ||
Updated•17 years ago
|
Status: NEW → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
Updated•17 years ago
|
Flags: in-testsuite?
Comment 9•17 years ago
|
||
Verified fixed using the testcase and Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9pre) Gecko/2008050614 Minefield/3.0pre + on Mac 10.5
I get no error when i load the testcase, the only "error" in the Debug Output/Error Console is :
Error: A script from "https://bugzilla.mozilla.org" was denied UniversalBrowserRead privileges.
Source File: https://bugzilla.mozilla.org/attachment.cgi?id=304664
Line: 5
but i think this is expected -> Verified fixed
Status: RESOLVED → VERIFIED
Comment 10•17 years ago
|
||
Carsten, note that this was only easily reproducible in a debug build; I'm not sure there were any obvious issues visible in a nightly for this bug.
Comment 11•17 years ago
|
||
fwiw, I can't reproduce the assertion failure with today's debug build on centos5 with either the bugzilla attachment or a version loaded from file: after granting the access.
You need to log in
before you can comment on or make changes to this bug.
Description
•