886704 - crash in AutoJSContextDestroyer::`scalar deleting destructor' @ js::DestroyContext

Status: RESOLVED INACTIVE

(Core :: XPConnect, defect)

Description

[Scoobidiver (away)]

It first showed up in 24.0a1/20130621. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=8ea92aeab783&tochange=7ba8c86f1a56

Signature 	js::DestroyContext(JSContext*, js::DestroyContextMode) More Reports Search
UUID	77e429d1-857c-40d5-9bba-59a372130625
Date Processed	2013-06-25 07:13:16
Uptime	68
Last Crash	1.2 minutes before submission
Install Age	19.3 minutes since version was first installed.
Install Time	2013-06-25 06:53:50
Product	Firefox
Version	24.0a1
Build ID	20130624031040
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7600
Build Architecture	x86
Build Architecture Info	AuthenticAMD family 16 model 5 stepping 3
Crash Reason	EXCEPTION_BREAKPOINT
Crash Address	0x6947f865
App Notes 	
AdapterVendorID: 0x10de, AdapterDeviceID: 0x0622, AdapterSubsysID: 054510de, AdapterDriverVersion: 9.18.13.1106
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
Processor Notes 	sp-processor07_phx1_mozilla_com_11657:2012
EMCheckCompatibility	True
Adapter Vendor ID	0x10de
Adapter Device ID	0x0622
Total Virtual Memory	4294836224
Available Virtual Memory	3572375552
System Memory Use Percentage	32
Available Page File	9584422912
Available Physical Memory	5796835328
Accessibility	Active

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::DestroyContext 	js/src/jscntxt.cpp:348
1 	mozjs.dll 	JS_DestroyContext 	js/src/jsapi.cpp:1279
2 	xul.dll 	AutoJSContextDestroyer::`scalar deleting destructor' 	
3 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/xpconnect/src/XPCWrappedJSClass.cpp:1641
4 	xul.dll 	nsXPCWrappedJS::CallMethod 	js/xpconnect/src/XPCWrappedJS.cpp:589
5 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:85
6 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:112
7 	xul.dll 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:938
8 	xul.dll 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:1010
9 	xul.dll 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:352
10 	xul.dll 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:635
11 	xul.dll 	nsEventDispatcher::DispatchDOMEvent 	content/events/src/nsEventDispatcher.cpp:693
12 	xul.dll 	GetEventAndTarget 	content/base/src/nsContentUtils.cpp:3260
13 	xul.dll 	nsINode::DispatchEvent 	content/base/src/nsINode.cpp:1149
14 	xul.dll 	nsDocument::DispatchContentLoadedEvents 	content/base/src/nsDocument.cpp:4509
15 	xul.dll 	nsRunnableMethodImpl<void 	obj-firefox/dist/include/nsThreadUtils.h:350

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3ADestroyContext%28JSContext*%2C+js%3A%3ADestroyContextMode%29

Comment 1

[Andrew McCreight [:mccr8]]

This crash means we're destroying a context that still has requests on it.

I looked at a few from 24, and they all involve nsDocument::DispatchContentLoadedEvents, and there's a lot of event stuff in that callstack, so cc'ing smaug.  On the other hand, in the regression window, the most suspicious looking landings are stuff by bholley (bug 883450 and bug 884362 and bug 884245) involving contexts.

Here's one with a deeper stack, though I don't know how helpful it is:
https://crash-stats.mozilla.com/report/index/634afda4-ba81-411f-9a0c-5769f2130625

Comment 2

[Bobby Holley (:bholley)]

This is a known issue, and the fix is bug 860085. But we can't fix that until bug 865745 lands, which per smaug's request depends on bug 880917, which is now blocked on some automation/releng stuff. :-(

Comment 3

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.