Bug 784730 - Crash in ReparentWrapperIfFound if wrapper already in scope. r=bholley
authorAndrew McCreight <amccreight@mozilla.com>
Wed, 06 Feb 2013 12:18:54 +0000
changeset 121544 35eda1ce617e0a3dc2d7006330dd80b086f388aa
parent 121543 c4562906fc61a36c0a6f4c3e48ab86acb6f038ce
child 121545 b721fde69bf0920dbccbe9ae18566ae79fb488b2
push id22784
push useramccreight@mozilla.com
push dateMon, 11 Feb 2013 22:48:21 +0000
treeherdermozilla-inbound@35eda1ce617e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbholley
bugs784730
milestone21.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 784730 - Crash in ReparentWrapperIfFound if wrapper already in scope. r=bholley
js/xpconnect/src/XPCMaps.h
js/xpconnect/src/XPCWrappedNative.cpp
--- a/js/xpconnect/src/XPCMaps.h
+++ b/js/xpconnect/src/XPCMaps.h
@@ -102,16 +102,17 @@ public:
             return nullptr;
         return entry->value;
     }
 
     inline XPCWrappedNative* Add(XPCWrappedNative* wrapper)
     {
         NS_PRECONDITION(wrapper,"bad param");
         nsISupports* obj = wrapper->GetIdentityObject();
+        MOZ_ASSERT(!Find(obj), "wrapper already in new scope!");
         Entry* entry = (Entry*)
             JS_DHashTableOperate(mTable, obj, JS_DHASH_ADD);
         if (!entry)
             return nullptr;
         if (entry->key)
             return entry->value;
         entry->key = obj;
         entry->value = wrapper;
--- a/js/xpconnect/src/XPCWrappedNative.cpp
+++ b/js/xpconnect/src/XPCWrappedNative.cpp
@@ -1577,18 +1577,18 @@ XPCWrappedNative::ReparentWrapperIfFound
                     NS_ASSERTION(oldProto->GetScriptableInfo()->GetScriptableShared() ==
                                  newProto->GetScriptableInfo()->GetScriptableShared(),
                                  "Changing proto is also changing JSObject Classname or "
                                  "helper's nsIXPScriptable flags. This is not allowed!");
 
                     wrapper->UpdateScriptableInfo(newProto->GetScriptableInfo());
                 }
 
-                NS_ASSERTION(!newMap->Find(wrapper->GetIdentityObject()),
-                             "wrapper already in new scope!");
+                if (newMap->Find(wrapper->GetIdentityObject()))
+                    MOZ_CRASH();
 
                 if (!newMap->Add(wrapper))
                     MOZ_CRASH();
             }
 
             JSObject *ww = wrapper->GetWrapper();
             if (ww) {
                 JSObject *newwrapper;