1106671 - Assertion failure !mEntered in xpc::CreateGlobalObject when running webcam.html reftest

Status: RESOLVED WORKSFORME

(Core :: XPConnect, defect)

Description

[Jon Coppeard (:jonco)]

I've been running the image/test/reftest/gif/webcam.html reftest a lot trying to track down bug 1105123, but I get the following crash every time:

$ ../mach reftest --filter webcam.html

 0:12.57 Assertion failure: !mEntered, at ../../../dist/include/mozilla/ReentrancyGuard.h:39
 0:12.57 #01: xpc::CreateGlobalObject(JSContext*, JSClass const*, nsIPrincipal*, JS::CompartmentOptions&)[/Users/jon/work/compacting/default-optdebug-build/dist/NightlyDebug.app/Contents/MacOS/XUL +0x83ec96]
 0:12.58 #02: XPCWrappedNative::WrapNewGlobal(xpcObjectHelper&, nsIPrincipal*, bool, JS::CompartmentOptions&, XPCWrappedNative**)[/Users/jon/work/compacting/default-optdebug-build/dist/NightlyDebug.app/Contents/MacOS/XUL +0x83da96]
 0:12.58 #03: nsXPConnect::InitClassesWithNewWrappedGlobal(JSContext*, nsISupports*, nsIPrincipal*, unsigned int, JS::CompartmentOptions&, nsIXPConnectJSObjectHolder**)[/Users/jon/work/compacting/default-optdebug-build/dist/NightlyDebug.app/Contents/MacOS/XUL +0x855a83]
 0:12.58 #04: mozJSComponentLoader::PrepareObjectForLocation(JSContext*, nsIFile*, nsIURI*, bool, bool*)[/Users/jon/work/compacting/default-optdebug-build/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7d5ac6]
 0:12.58 #05: mozJSComponentLoader::ObjectForLocation(ComponentLoaderInfo&, nsIFile*, JS::MutableHandle<JSObject*>, JS::MutableHandle<JSScript*>, char**, bool, JS::MutableHandle<JS::Value>)[/Users/jon/work/compacting/default-optdebug-build/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7d4613]
 0:12.58 #06: mozJSComponentLoader::LoadModule(mozilla::FileLocation&)[/Users/jon/work/compacting/default-optdebug-build/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7d3a9c]
 0:12.58 #07: nsFactoryEntry::GetFactory()[/Users/jon/work/compacting/default-optdebug-build/dist/NightlyDebug.app/Contents/MacOS/XUL +0xb3a65]
 0:12.58 #08: nsComponentManagerImpl::CreateInstanceByContractID(char const*, nsISupports*, nsID const&, void**)[/Users/jon/work/compacting/default-optdebug-build/dist/NightlyDebug.app/Contents/MacOS/XUL +0xb4328]
 0:12.58 #09: nsComponentManagerImpl::GetServiceByContractID(char const*, nsID const&, void**)[/Users/jon/work/compacting/default-optdebug-build/dist/NightlyDebug.app/Contents/MacOS/XUL +0xb0224]
 0:12.59 #10: nsIOService::GetProtocolHandler(char const*, nsIProtocolHandler**)[/Users/jon/work/compacting/default-optdebug-build/dist/NightlyDebug.app/Contents/MacOS/XUL +0x17c770]
 0:12.59 #11: nsIOService::NewURI(nsACString_internal const&, char const*, nsIURI*, nsIURI**)[/Users/jon/work/compacting/default-optdebug-build/dist/NightlyDebug.app/Contents/MacOS/XUL +0x17ca38]
 0:12.59 #12: NS_InvokeByIndex[/Users/jon/work/compacting/default-optdebug-build/dist/NightlyDebug.app/Contents/MacOS/XUL +0xd2b5d]
 0:12.59 #13: CallMethodHelper::Call()[/Users/jon/work/compacting/default-optdebug-build/dist/NightlyDebug.app/Contents/MacOS/XUL +0x85eb69]
 0:12.59 #14: XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)[/Users/jon/work/compacting/default-optdebug-build/dist/NightlyDebug.app/Contents/MacOS/XUL +0x845e3b]
 0:12.59 #15: XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*)[/Users/jon/work/compacting/default-optdebug-build/dist/NightlyDebug.app/Contents/MacOS/XUL +0x847c4d]
 0:12.59 #16: js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct)[/Users/jon/work/compacting/default-optdebug-build/dist/NightlyDebug.app/Contents/MacOS/XUL +0x38e05b2]

Comment 1

[Jon Coppeard (:jonco)]

Attachment: reftest log

Comment 2

[Jon Coppeard (:jonco)]

Attachment: interp-crash

It seems to be related to accessing the interposition map after it has been deleted.  The attached patch fixes the crash, although it doesn't explain how this happens.

Comment 3

[Jon Coppeard (:jonco)]

This seems to have stopped happening now so closing this.

Comment 4

[Bob Owen (:bobowen)]

(In reply to Jon Coppeard (:jonco) from comment #3)
> This seems to have stopped happening now so closing this.

Looks like bug 1123868 landed the same patch as in comment 2. :)