1223774 - crash in mozilla::dom::Console::Console on 2015-11-10 Nighty

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Ed Morley [:emorley]]

This bug was filed from the Socorro interface and is 
report bp-2b9a879b-fe32-4287-909b-5ea1e2151111.
=============================================================

I'd just opened:
https://github.com/mozilla/treeherder/pull/1138

And from there had used the travis status link (click the green link) to open in two background tabs, these two links:
https://travis-ci.org/mozilla/treeherder/builds/90495096
https://travis-ci.org/mozilla/treeherder/builds/90496913

Roughly a second later the crash occurred.


Windows 8.1 x64, but using the 32bit Nightly.
Today's Nightly (2015-11-10), built from https://hg.mozilla.org/mozilla-central/rev/cc473fe5dc512c450634506f68cbacfb40a06a23

e10s disabled
addons: adblock, noscript, and a couple of others (see crash report metadata page)

Comment 1

[Ed Morley [:emorley]]

s/green link/green tick icon/

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Hmm, null + offset crash? We get a null outer window, but I don't even pretend to understand the
wrapper setup we have here. AddonWrapper, CrossCompartmentWrapper and Proxy. Where are we dealing with outer window, where inner, or always inner or what?

Comment 3

[Boris Zbarsky [:bzbarsky]]

It's quite odd to have a null outer on an inner.  How can that happen?

Comment 4

[Boris Zbarsky [:bzbarsky]]

Though I guess FORWARD_TO_OUTER_OR_THROW null-checks the outer.  Not sure whether that's just paranoia or justified.

Comment 5

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

There's lots of null-checking of mOuterWindow in nsGlobalWindow. I don't think it's just paranoia. But it's not clear to me how it can happen other than via unlinking.

Comment 6

[Ed Morley [:emorley]]

And again:
bp-e704f503-9d2f-4a41-9b26-7b6a32151123

Comment 7

[Andrea Marchesini [:baku]]

Attachment: console.patch

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 8690804 [details] [diff] [review]
console.patch

>+    if (!outerWindow) {
>+      mOuterID = outerWindow->WindowID();
>+    }
I'm pretty sure you don't want that '!' ;)


That fixed, r+.






So is something keeping a weak-ref-ish thing to inner window and using Window object after unlinking or
or perhaps something isn't unlinking everything properly and ends up handing already unlinked inner window to JS or...
I wonder if we should make WrapObject to fail on inner windows which don't have outer.

Comment 9

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/cd5c09ba9561

Comment 10

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/cd5c09ba9561