711602 - "ASSERTION: bad size recorded" with mozVibrate

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: bad size recorded: 'aInstanceSize == 0 || entry->GetClassSize() == aInstanceSize', file /builds/slave/m-cen-osx64-dbg/build/xpcom/base/nsTraceRefcntImpl.cpp, line 473

NS_LogAddRef_P [xpcom/base/nsTraceRefcntImpl.cpp:998]
mozilla::ClearOnShutdown_Internal::ShutdownObserver<nsAutoPtr<InfallibleTArray<long long unsigned int> > >::AddRef [down.h:79]
nsObserverList::AddObserver [nsCOMPtr.h:889]
mozilla::ClearOnShutdown<nsAutoPtr<InfallibleTArray<long long unsigned int> > > [:519]
mozilla::hal::Vibrate [hal/Hal.cpp:115]
mozilla::dom::Navigator::MozVibrate [nsCOMPtr.h:519]
NS_InvokeByIndex_P [xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_64_unix.cpp:197]

###!!! ASSERTION: bad size recorded: 'aInstanceSize == 0 || entry->GetClassSize() == aInstanceSize', file /builds/slave/m-cen-osx64-dbg/build/xpcom/base/nsTraceRefcntImpl.cpp, line 473

NS_LogAddRef_P [xpcom/base/nsTraceRefcntImpl.cpp:998]
mozilla::ClearOnShutdown_Internal::ShutdownObserver<nsRefPtr<mozilla::dom::<unnamed>::VibrateWindowListener> >::AddRef [ClearOnShutdown.h:79]
nsObserverList::FillObserverArray [nsCOMPtr.h:880]
nsObserverList::NotifyObservers [xpcom/ds/nsObserverList.cpp:127]
nsObserverService::NotifyObservers [nsTHashtable.h:163]
mozilla::ShutdownXPCOM [xpcom/glue/nsCOMPtr.h:519]
ScopedXPCOMStartup::~ScopedXPCOMStartup [toolkit/xre/nsAppRunner.cpp:1115]
XRE_main [nsCOMPtr.h:807]
main [browser/app/nsBrowserApp.cpp:201]

Tested with http://hg.mozilla.org/mozilla-central/rev/7cc472108eb4

Comment 1

[Justin Lebar (not reading bugmail)]

This is almost surely a result of the NS_ISUPPORTS implementation hack I have for ClearOnShutdown<T>.  Sigh.

Comment 2

[Justin Lebar (not reading bugmail)]

Hm, I can't reproduce with a local debug, trace-malloc build, rev 7ccc472.  I verified that ClearOnShutdown is being called.

Comment 3

[Justin Lebar (not reading bugmail)]

I do see this in the mochitest-3 logs, however.

Comment 4

[Justin Lebar (not reading bugmail)]

Attachment: Assertions from mochitest logs

Not the same stacks as in comment 0, strangely.

Comment 5

[Justin Lebar (not reading bugmail)]

Maybe the trace refcnt assertions just aren't on when I run dist/bin/firefox?  I see the assertions when I run the vibrator mochitest locally.

Comment 6

[Justin Lebar (not reading bugmail)]

Attachment: Patch v1

Reading through the implementation of INLINE_REFCOUNTING and DECL_{ADDREF,RELEASE}, it's not entirely clear to me why this works.  But it does seem to work.

Comment 7

[Benjamin Smedberg]

Comment on attachment 582902 [details] [diff] [review]
Patch v1

This turns out to just be a name collision with the other ShutdownObserver in gfx-land.

Comment 8

[Justin Lebar (not reading bugmail)]

I'll fully qualify the class name in the NS_IMPL macros.

Comment 9

[Justin Lebar (not reading bugmail)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/dd2f9236b591

Comment 10

[Justin Lebar (not reading bugmail)]

Verified that there's no assertion in https://tbpl.mozilla.org/php/getParsedLog.php?id=8039971&tree=Mozilla-Inbound

Comment 11

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/dd2f9236b591

Comment 12

[Jesse Ruderman]

(In reply to Justin Lebar [:jlebar] from comment #5)
> Maybe the trace refcnt assertions just aren't on when I run
> dist/bin/firefox?  I see the assertions when I run the vibrator mochitest
> locally.

I see the assertion (in an old build) if I run with XPCOM_MEM_LEAK_LOG=2.

Comment 13

[(not currently active) Ted Mielczarek]

Yes, refcnt logging isn't enabled by default, you have to set an environment variable to enable it. Mochitest does this by default:
http://mxr.mozilla.org/mozilla-central/source/testing/mochitest/runtests.py#543