diff --git a/dom/tests/browser/browser.ini b/dom/tests/browser/browser.ini index 91f7731c2d50..ad36049e7b33 100644 --- a/dom/tests/browser/browser.ini +++ b/dom/tests/browser/browser.ini @@ -106,6 +106,5 @@ support-files = [browser_keypressTelemetry.js] skip-if = webrender [browser_windowProxy_transplant.js] -skip-if = (!fission && (os == 'linux' || os == 'mac')) || (fission && os == 'linux' && bits == 64 && os_version == '18.04') # Bug 1582568; Bug 1581862, bug 1608600 support-files = file_postMessage_parent.html diff --git a/js/src/proxy/CrossCompartmentWrapper.cpp b/js/src/proxy/CrossCompartmentWrapper.cpp index 547aa5c9370c..106201abc397 100644 --- a/js/src/proxy/CrossCompartmentWrapper.cpp +++ b/js/src/proxy/CrossCompartmentWrapper.cpp @@ -526,8 +526,6 @@ void js::RemapWrapper(JSContext* cx, JSObject* wobjArg, MOZ_ASSERT(!newTarget->is()); JSObject* origTarget = Wrapper::wrappedObject(wobj); MOZ_ASSERT(origTarget); - MOZ_ASSERT(!JS_IsDeadWrapper(origTarget), - "We don't want a dead proxy in the wrapper map"); JS::Compartment* wcompartment = wobj->compartment(); MOZ_ASSERT(wcompartment != newTarget->compartment()); @@ -548,6 +546,14 @@ void js::RemapWrapper(JSContext* cx, JSObject* wobjArg, // When we remove origv from the wrapper map, its wrapper, wobj, must // immediately cease to be a cross-compartment wrapper. Nuke it. NukeCrossCompartmentWrapper(cx, wobj); + + // If the target is a dead wrapper, and we're just fixing wrappers for + // it, then we're done now that the CCW is a dead wrapper. + if (JS_IsDeadWrapper(origTarget)) { + MOZ_RELEASE_ASSERT(origTarget == newTarget); + return; + } + js::RemapDeadWrapper(cx, wobj, newTarget); } diff --git a/js/xpconnect/wrappers/WrapperFactory.cpp b/js/xpconnect/wrappers/WrapperFactory.cpp index b318b8db5242..f04e339703d0 100644 --- a/js/xpconnect/wrappers/WrapperFactory.cpp +++ b/js/xpconnect/wrappers/WrapperFactory.cpp @@ -826,6 +826,11 @@ static void NukeXrayWaiver(JSContext* cx, JS::HandleObject obj) { scope->mWaiverWrapperMap->Remove(key); js::NukeNonCCWProxy(cx, waiver); + + // Get rid of any CCWs the waiver may have had. + if (!JS_RefreshCrossCompartmentWrappers(cx, waiver)) { + MOZ_CRASH(); + } } JSObject* TransplantObjectNukingXrayWaiver(JSContext* cx,