1041656 - [e10s] nsContentUtils::RemoveScriptBlocker() crash in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsCOMArray<mozilla::dom::EventTarget>*)

Status: VERIFIED FIXED

(Core :: General, defect)

Description

[Chris Peterson [:cpeterson]]

This bug was filed from the Socorro interface and is 
report bp-5287cee1-80af-4f85-a553-a13332140721.
=============================================================

I see this EventDispatcher crash about twice a day when using e10s. I don't have STR, but it seems to happen when opening a new tab or quickly zooming in and out of the Mozilla Location Service map (which dynamically loads map tiles):

https://location.services.mozilla.com/map

Comment 1

[Chris Peterson [:cpeterson]]

More of my crash reports with nsContentUtils::RemoveScriptBlocker() calling into EventDispatcher:

bp-74dc1f92-f38a-46b4-bb26-1353a2140721
bp-234e9f50-ccbe-44d6-82b1-018a32140721
bp-fca69138-efa3-41d9-b9bf-e34102140719
bp-b7aff62a-d8e1-46fd-a6cf-9694f2140719

Frame 	Module 	Signature 	Source
0 	XUL 	mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsCOMArray<mozilla::dom::EventTarget>*) 	obj-firefox/x86_64/dist/include/nsTArray.h
1 	XUL 	mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, nsIDOMEvent*, nsPresContext*, nsEventStatus*) 	dom/events/EventDispatcher.cpp
2 	XUL 	nsINode::DispatchEvent(nsIDOMEvent*, bool*) 	content/base/src/nsINode.cpp
3 	XUL 	mozilla::AsyncEventDispatcher::Run() 	dom/events/AsyncEventDispatcher.cpp
4 	XUL 	nsContentUtils::RemoveScriptBlocker() 	content/base/src/nsContentUtils.cpp
5 	XUL 	mozilla::dom::Element::SetAttr(int, nsIAtom*, nsIAtom*, nsAString_internal const&, bool) 	obj-firefox/x86_64/dist/include/nsContentUtils.h
6 	XUL 	nsGenericHTMLElement::SetAttr(int, nsIAtom*, nsIAtom*, nsAString_internal const&, bool) 	content/html/content/src/nsGenericHTMLElement.cpp
7 	XUL 	mozilla::dom::HTMLSharedElement::SetAttr(int, nsIAtom*, nsIAtom*, nsAString_internal const&, bool) 	content/html/content/src/HTMLSharedElement.cpp
8 	XUL 	mozilla::dom::Element::SetAttribute(nsAString_internal const&, nsAString_internal const&, mozilla::ErrorResult&) 	obj-firefox/x86_64/dist/include/mozilla/dom/Element.h
9 	XUL 	mozilla::dom::ElementBinding::setAttribute 	obj-firefox/x86_64/dom/bindings/ElementBinding.cpp
10 	XUL 	mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) 	dom/bindings/BindingUtils.cpp
11 	XUL 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/jscntxtinlines.h
12 	XUL 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
13 	XUL 	js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const 	js/src/jsproxy.cpp
14 	XUL 	js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/jsproxy.cpp
15 	XUL 	js::proxy_Call(JSContext*, unsigned int, JS::Value*) 	js/src/jsproxy.cpp
16 	XUL 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/jscntxtinlines.h
17 	XUL 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
18 	XUL 	JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) 	js/src/jsapi.cpp
19 	XUL 	mozilla::jsipc::WrapperAnswer::AnswerCallOrConstruct(unsigned long long const&, nsTArray<mozilla::jsipc::JSParam> const&, bool const&, mozilla::jsipc::ReturnStatus*, mozilla::jsipc::JSVariant*, nsTArray<mozilla::jsipc::JSParam>*) 	js/ipc/WrapperAnswer.cpp
20 	XUL 	_ZThn24_N7mozilla5jsipc14JavaScriptBaseINS0_16PJavaScriptChildEE21AnswerCallOrConstructERKyRK8nsTArrayINS0_7JSParamEERKbPNS0_12ReturnStatusEPNS0_9JSVariantEPS8_ 	js/ipc/JavaScriptBase.h
21 	XUL 	mozilla::jsipc::PJavaScriptChild::OnCallReceived(IPC::Message const&, IPC::Message*&) 	obj-firefox/x86_64/ipc/ipdl/PJavaScriptChild.cpp
22 	XUL 	mozilla::ipc::MessageChannel::DispatchUrgentMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp
23 	XUL 	mozilla::ipc::MessageChannel::ProcessPendingUrgentRequest() 	ipc/glue/MessageChannel.cpp
24 	XUL 	mozilla::ipc::MessageChannel::SendAndWait(IPC::Message*, IPC::Message*) 	ipc/glue/MessageChannel.cpp
25 	XUL 	mozilla::ipc::MessageChannel::RPCCall(IPC::Message*, IPC::Message*) 	ipc/glue/MessageChannel.cpp
26 	XUL 	mozilla::ipc::MessageChannel::Call(IPC::Message*, IPC::Message*) 	ipc/glue/MessageChannel.cpp
27 	XUL 	mozilla::dom::PBrowserChild::CallRpcMessage(nsString const&, mozilla::dom::ClonedMessageData const&, nsTArray<mozilla::jsipc::CpowEntry> const&, IPC::Principal const&, nsTArray<nsString>*) 	obj-firefox/x86_64/ipc/ipdl/PBrowserChild.cpp
28 	XUL 	mozilla::dom::TabChild::DoSendBlockingMessage(JSContext*, nsAString_internal const&, mozilla::dom::StructuredCloneData const&, JS::Handle<JSObject*>, nsIPrincipal*, nsTArray<nsString>*, bool) 	dom/ipc/TabChild.cpp
29 	XUL 	_ZThn56_N7mozilla3dom8TabChild21DoSendBlockingMessageEP9JSContextRK18nsAString_internalRKNS0_19StructuredCloneDataEN2JS6HandleIP8JSObjectEEP12nsIPrincipalP8nsTArrayI8nsStringEb 	obj-firefox/x86_64/dom/ipc/Unified_cpp_dom_ipc0.cpp
30 	XUL 	nsFrameMessageManager::SendMessage(nsAString_internal const&, JS::Handle<JS::Value>, JS::Handle<JS::Value>, nsIPrincipal*, JSContext*, unsigned char, JS::MutableHandle<JS::Value>, bool) 	content/base/src/nsFrameMessageManager.cpp
31 	XUL 	nsFrameMessageManager::SendRpcMessage(nsAString_internal const&, JS::Handle<JS::Value>, JS::Handle<JS::Value>, nsIPrincipal*, JSContext*, unsigned char, JS::MutableHandle<JS::Value>) 	content/base/src/nsFrameMessageManager.cpp
32 	XUL 	NS_InvokeByIndex 	xpcom/reflect/xptcall/md/unix/xptcinvoke_x86_64_unix.cpp
33 	XUL 	XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) 	js/xpconnect/src/XPCWrappedNative.cpp
34 	XUL 	XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp
35 	XUL 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/jscntxtinlines.h
36 	XUL 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
37 	XUL 	js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const 	js/src/jsproxy.cpp
38 	XUL 	js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/jsproxy.cpp
39 	XUL 	js::proxy_Call(JSContext*, unsigned int, JS::Value*) 	js/src/jsproxy.cpp
40 	XUL 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/jscntxtinlines.h
41 	XUL 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
42 	XUL 	js::jit::DoCallFallback 	js/src/jit/BaselineIC.cpp
43 		@0x108aceae8

Comment 2

[Chris Peterson [:cpeterson]]

I hit this crash so often (on two different machines and profiles, with addons and without addons) that I had to disable e10s autostart. I think this is a new-ish problem, so Firefox 32 is probably unaffected.

Comment 3

[Brad Lassey [:blassey] (use needinfo?)]

Bill, I've seen this crash dozens of times in the last 2 days. Could it be related to the changes you landed last week?

Comment 4

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

I'm going to close this. It was fixed by the backout of bug 950745. I'll leave the other bugs with STRs open so I can re-test the script blocker fix in bug 1042587.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Does something need backing out from Aurora too?

Comment 6

[Chris Peterson [:cpeterson]]

We don't care about e10s bugs on the Aurora, Beta, or Release channels.

Comment 7

[[SV Manager] Florin Mezei, QA (:FlorinMezei)]

Socorro [1] shows the following for the past 4 weeks:
- 2 crashes with this signature in Firefox 35 Nightly
- 3 crashes with this signature in Firefox 36 Nightly

Given the very low count for Nightly, I'm marking this as Verified.

[1] https://crash-stats.mozilla.com/report/list?product=Firefox&range_unit=days&range_value=28&signature=mozilla%3A%3AEventDispatcher%3A%3ADispatch%28nsISupports%2A%2C+nsPresContext%2A%2C+mozilla%3A%3AWidgetEvent%2A%2C+nsIDOMEvent%2A%2C+nsEventStatus%2A%2C+mozilla%3A%3AEventDispatchingCallback%2A%2C+nsCOMArray%3Cmozilla%3A%3Adom%3A%3AEventTarget%3E%2A%29