Well, this is exciting. The assert is: JS_ASSERT(target->isNative() == obj->isNative()); In this case target->getClass() == &js::Objectclass, but obj is a proxy whose proxy is, not surprisingly, mozilla::dom::HTMLSelectElementBinding::DOMProxyHandler.

So ReparentWrapper uses a vanilla object to hold the properties from aObj and then put them back on the new aObj. But in this case aObj is a proxy, and JS_CopyPropertiesFrom can't copy from a proxy to a non-proxy, I guess. Should we be copying from the expando object for the proxy case? Do we have any other DOM proxies that can come through this code?

Yeah, we were not supposed to have proxies for nodes yet, reparenting is broken there.

Extracted from the HTMLDocument patch.

Comment on attachment 738126 [details] [diff] [review] v1 r=me

Backed out for mochitest-2 failures. https://hg.mozilla.org/integration/mozilla-inbound/rev/897654df47b6 https://tbpl.mozilla.org/php/getParsedLog.php?id=21915174&tree=Mozilla-Inbound 08:41:31 INFO - 1199 INFO TEST-START | /tests/dom/bindings/test/test_traceProtos.html 08:41:32 WARNING - TEST-UNEXPECTED-FAIL | /tests/dom/bindings/test/test_traceProtos.html | Exited with code 11 during test run 08:41:32 INFO - INFO | automation.py | Application ran for: 0:01:36.688397 08:41:32 INFO - INFO | zombiecheck | Reading PID log: /tmp/tmpRlJegTpidlog 08:41:32 INFO - mozcrash INFO | Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-linux64/1366211287/firefox-23.0a1.en-US.linux-x86_64.crashreporter-symbols.zip 08:41:32 INFO - Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-linux64/1366211287/firefox-23.0a1.en-US.linux-x86_64.crashreporter-symbols.zip 08:41:57 WARNING - PROCESS-CRASH | /tests/dom/bindings/test/test_traceProtos.html | application crashed [@ CanonicalizeXPCOMParticipant] 08:41:57 INFO - Crash dump filename: /tmp/tmp5AJXkg/minidumps/713c4995-e4ae-c6e8-00b5067f-2e39d0fd.dmp 08:41:57 INFO - Operating system: Linux 08:41:57 INFO - 0.0.0 Linux 3.2.0-23-generic #36-Ubuntu SMP Tue Apr 10 20:39:51 UTC 2012 x86_64 08:41:57 INFO - CPU: amd64 08:41:57 INFO - family 6 model 45 stepping 7 08:41:57 INFO - 1 CPU 08:41:57 INFO - Crash reason: SIGSEGV 08:41:57 INFO - Crash address: 0x0 08:41:57 INFO - Thread 0 (crashed) 08:41:57 INFO - 0 libxul.so!CanonicalizeXPCOMParticipant [nsCycleCollector.cpp:409285b3f69c : 622 + 0x0] 08:41:57 INFO - rbx = 0x00007fffbabc8ab0 r12 = 0x00007fffbabc8ab0 08:41:57 INFO - r13 = 0x00007fffbabc8940 r14 = 0x00007fffffffffff 08:41:57 INFO - r15 = 0xfffb7fffffffffff rip = 0x00007f05895fe4b5 08:41:57 INFO - rsp = 0x00007fffbabc88f0 rbp = 0x00007fffbabc8900 08:41:57 INFO - Found by: given as instruction pointer in context 08:41:57 INFO - 1 libxul.so!WrappedNativeProtoShutdownEnumerator [XPCWrappedNativeScope.cpp:409285b3f69c : 633 + 0x8] 08:41:57 INFO - rip = 0x00007f05890cabd9 rsp = 0x00007fffbabc88f8 08:41:57 INFO - rbp = 0x00007fffbabc8900 08:41:57 INFO - Found by: stack scanning 08:41:57 INFO - 2 libxul.so!GCGraphBuilder::NoteXPCOMRoot(nsISupports*) [nsCycleCollector.cpp:409285b3f69c : 1862 + 0x4] 08:41:57 INFO - rip = 0x00007f05895ffdac rsp = 0x00007fffbabc8910 08:41:57 INFO - rbp = 0x00007fffbabc8930 08:41:57 INFO - Found by: stack scanning 08:41:57 INFO - 3 libxul.so!XPCWrappedNativeScope::SuspectAllWrappers(XPCJSRuntime*, nsCycleCollectionTraversalCallback&) [XPCWrappedNativeScope.cpp:409285b3f69c : 433 + 0xc] 08:41:57 INFO - rip = 0x00007f05890cb934 rsp = 0x00007fffbabc8940 08:41:57 INFO - rbp = 0x00007fffbabc8990 08:41:57 INFO - Found by: stack scanning

Hmm, I probably need to clear the expando object first, otherwise EnsureExpandoObject just returns the existing object :-/.

Comment on attachment 739027 [details] [diff] [review] Clear the exando object before cloning r=me