1232709 - MOZ_ASSERT(mod->obj, "Import table contains entry with no object");

Status: RESOLVED DUPLICATE of bug 1225160

(Core :: XPConnect, defect)

Description

[Tom Tromey :tromey]

I am using a debug build of today's fx-team on x86-64 Linux (Fedora 22).

I run firefox with "./mach run -P".
Then I open the browser toolbox and click "ok" on the dialog asking
permission.  The browser toolbox opens.

Shortly after this, the parent process fails this assert:

https://dxr.mozilla.org/mozilla-central/source/js/xpconnect/loader/mozJSComponentLoader.cpp#1198

Here's a partial stack trace.

(gdb) bt
#0  0x00007ff4a184658d in mozJSComponentLoader::ImportInto (this=this@entry=0x1dc47c0, aLocation=..., targetObj=..., targetObj@entry=(JSObject * const) 0x7ff481102a40 [object Object], callercx=callercx@entry=0x1b1b140, vp=..., vp@entry=0x0) at /home/tromey/firefox-git/hg2/js/xpconnect/loader/mozJSComponentLoader.cpp:1198
#1  0x00007ff4a1847275 in mozJSComponentLoader::Import (this=0x1dc47c0, registryLocation=..., targetValArg=..., cx=0x1b1b140, optionalArgc=<optimized out>, retval=...) at /home/tromey/firefox-git/hg2/js/xpconnect/loader/mozJSComponentLoader.cpp:1045
#2  0x00007ff4a1852dde in nsXPCComponents_Utils::Import (this=<optimized out>, registryLocation=..., targetObj=$jsval((JSObject *) 0x7ff481102a40 [object Object]), cx=0x1b1b140, optionalArgc=<optimized out>, retval=...) at /home/tromey/firefox-git/hg2/js/xpconnect/src/XPCComponents.cpp:2482
#3  0x00007ff4a11c7585 in NS_InvokeByIndex (that=<optimized out>, methodIndex=<optimized out>, paramCount=<optimized out>, params=<optimized out>) at /home/tromey/firefox-git/hg2/xpcom/reflect/xptcall/md/unix/xptcinvoke_x86_64_unix.cpp:176
#4  0x00007ff4a18a2524 in CallMethodHelper::Invoke (this=0x7ffe33d17980) at /home/tromey/firefox-git/hg2/js/xpconnect/src/XPCWrappedNative.cpp:2097
#5  CallMethodHelper::Call (this=0x7ffe33d17980) at /home/tromey/firefox-git/hg2/js/xpconnect/src/XPCWrappedNative.cpp:1414
#6  0x00007ff4a18927eb in XPCWrappedNative::CallMethod (ccx=..., mode=<optimized out>) at /home/tromey/firefox-git/hg2/js/xpconnect/src/XPCWrappedNative.cpp:1381
#7  0x00007ff4a1896bb2 in XPC_WN_CallMethod (cx=cx@entry=0x1b1b140, argc=<optimized out>, vp=0x61b7df8) at /home/tromey/firefox-git/hg2/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1115
#8  0x00007ff4a3ebf499 in js::CallJSNative (cx=cx@entry=0x1b1b140, native=0x7ff4a18969c6 <XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*)>, args=...) at /home/tromey/firefox-git/hg2/js/src/jscntxtinlines.h:235
#9  0x00007ff4a3eb4897 in js::Invoke (cx=0x1b1b140, args=..., construct=js::NO_CONSTRUCT) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:444
#10 0x00007ff4a3ea6c3e in Interpret (cx=0x1b1b140, state=...) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:2766
#11 0x00007ff4a3eb4667 in js::RunScript (cx=cx@entry=0x1b1b140, state=...) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:391
#12 0x00007ff4a3eb4982 in js::Invoke (cx=cx@entry=0x1b1b140, args=..., construct=construct@entry=js::NO_CONSTRUCT) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:462
#13 0x00007ff4a3d26c14 in js::fun_call (cx=cx@entry=0x1b1b140, argc=<optimized out>, vp=vp@entry=0x61b7d48) at /home/tromey/firefox-git/hg2/js/src/jsfun.cpp:1192
#14 0x00007ff4a3d3354b in js::fun_apply (cx=cx@entry=0x1b1b140, argc=1, vp=0x61b7d48) at /home/tromey/firefox-git/hg2/js/src/jsfun.cpp:1210
#15 0x00007ff4a3ebf499 in js::CallJSNative (cx=cx@entry=0x1b1b140, native=0x7ff4a3d33470 <js::fun_apply(JSContext*, unsigned int, JS::Value*)>, args=...) at /home/tromey/firefox-git/hg2/js/src/jscntxtinlines.h:235
#16 0x00007ff4a3eb4897 in js::Invoke (cx=0x1b1b140, args=..., construct=js::NO_CONSTRUCT) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:444
#17 0x00007ff4a3ea6c3e in Interpret (cx=0x1b1b140, state=...) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:2766
#18 0x00007ff4a3eb4667 in js::RunScript (cx=cx@entry=0x1b1b140, state=...) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:391
#19 0x00007ff4a3eb4982 in js::Invoke (cx=cx@entry=0x1b1b140, args=..., construct=construct@entry=js::NO_CONSTRUCT) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:462
#20 0x00007ff4a3eb5499 in js::Invoke (cx=cx@entry=0x1b1b140, thisv=..., fval=..., argc=<optimized out>, argv=0x7ffe33d195d8, rval=...) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:496
#21 0x00007ff4a3dda753 in js::DirectProxyHandler::call (this=this@entry=0x7ff4a66e1df0 <js::CrossCompartmentWrapper::singleton>, cx=cx@entry=0x1b1b140, proxy=..., proxy@entry=(JSObject * const) 0x7ff471c28ac0 [object Proxy], args=...) at /home/tromey/firefox-git/hg2/js/src/proxy/DirectProxyHandler.cpp:77
#22 0x00007ff4a3ddf1f3 in js::CrossCompartmentWrapper::call (this=0x7ff4a66e1df0 <js::CrossCompartmentWrapper::singleton>, cx=0x1b1b140, wrapper=..., args=...) at /home/tromey/firefox-git/hg2/js/src/proxy/CrossCompartmentWrapper.cpp:289
#23 0x00007ff4a3ddc20a in js::Proxy::call (cx=cx@entry=0x1b1b140, proxy=proxy@entry=(JSObject * const) 0x7ff471c28ac0 [object Proxy], args=...) at /home/tromey/firefox-git/hg2/js/src/proxy/Proxy.cpp:391
#24 0x00007ff4a3ddc2d4 in js::proxy_Call (cx=cx@entry=0x1b1b140, argc=<optimized out>, vp=<optimized out>) at /home/tromey/firefox-git/hg2/js/src/proxy/Proxy.cpp:683
#25 0x00007ff4a3ebf499 in js::CallJSNative (cx=cx@entry=0x1b1b140, native=0x7ff4a3ddc260 <js::proxy_Call(JSContext*, unsigned int, JS::Value*)>, args=...) at /home/tromey/firefox-git/hg2/js/src/jscntxtinlines.h:235
#26 0x00007ff4a3eb4a81 in js::Invoke (cx=cx@entry=0x1b1b140, args=..., construct=construct@entry=js::NO_CONSTRUCT) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:432
#27 0x00007ff4a3eb5499 in js::Invoke (cx=cx@entry=0x1b1b140, thisv=..., fval=..., argc=argc@entry=0, argv=argv@entry=0x0, rval=..., rval@entry=JSVAL_VOID) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:496
#28 0x00007ff4a3eb5644 in js::InvokeGetter (cx=cx@entry=0x1b1b140, thisv=..., fval=$jsval((JSObject *) 0x7ff471c28ac0 [object Proxy]), rval=rval@entry=JSVAL_VOID) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:605
#29 0x00007ff4a3eb5866 in CallGetter (vp=JSVAL_VOID, shape=0x7ff471c55078, receiver=$jsval((JSObject *) 0x7ff471d96920 [object BackstagePass] delegate), obj=(JSObject * const) 0x7ff471d96920 [object BackstagePass] delegate, cx=0x1b1b140) at /home/tromey/firefox-git/hg2/js/src/vm/NativeObject.cpp:1663
#30 GetExistingProperty<(js::AllowGC)1> (cx=0x1b1b140, receiver=..., obj=(js::NativeObject * const) 0x7ff471d96920 [object BackstagePass] delegate, shape=0x7ff471c55078, vp=JSVAL_VOID) at /home/tromey/firefox-git/hg2/js/src/vm/NativeObject.cpp:1711
#31 0x00007ff4a3eb5ca7 in js::NativeGetExistingProperty (cx=cx@entry=0x1b1b140, receiver=..., receiver@entry=(JSObject * const) 0x7ff471d96920 [object BackstagePass] delegate, obj=(js::NativeObject * const) 0x7ff471d96920 [object BackstagePass] delegate, shape=0x7ff471c55078, vp=..., vp@entry=JSVAL_VOID) at /home/tromey/firefox-git/hg2/js/src/vm/NativeObject.cpp:1734
#32 0x00007ff4a3b24aef in js::FetchName<false> (cx=0x1b1b140, obj=..., obj2=..., name=..., shape=..., vp=...) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter-inl.h:202
#33 0x00007ff4a3ea7b13 in GetNameOperation (vp=..., pc=<optimized out>, fp=<optimized out>, cx=<optimized out>) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:244
#34 Interpret (cx=0x1b1b140, state=...) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:2891
#35 0x00007ff4a3eb4667 in js::RunScript (cx=cx@entry=0x1b1b140, state=...) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:391
#36 0x00007ff4a3eb4982 in js::Invoke (cx=cx@entry=0x1b1b140, args=..., construct=construct@entry=js::NO_CONSTRUCT) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:462
#37 0x00007ff4a3eb5499 in js::Invoke (cx=cx@entry=0x1b1b140, thisv=..., fval=..., argc=<optimized out>, argv=0x7ffe33d1a338, rval=...) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:496
#38 0x00007ff4a3dda753 in js::DirectProxyHandler::call (this=this@entry=0x7ff4a66e1df0 <js::CrossCompartmentWrapper::singleton>, cx=cx@entry=0x1b1b140, proxy=..., proxy@entry=(JSObject * const) 0x7ff39a3f7920 [object Proxy], args=...) at /home/tromey/firefox-git/hg2/js/src/proxy/DirectProxyHandler.cpp:77
#39 0x00007ff4a3ddf1f3 in js::CrossCompartmentWrapper::call (this=0x7ff4a66e1df0 <js::CrossCompartmentWrapper::singleton>, cx=0x1b1b140, wrapper=..., args=...) at /home/tromey/firefox-git/hg2/js/src/proxy/CrossCompartmentWrapper.cpp:289
#40 0x00007ff4a3ddc20a in js::Proxy::call (cx=cx@entry=0x1b1b140, proxy=proxy@entry=(JSObject * const) 0x7ff39a3f7920 [object Proxy], args=...) at /home/tromey/firefox-git/hg2/js/src/proxy/Proxy.cpp:391
#41 0x00007ff4a3ddc2d4 in js::proxy_Call (cx=cx@entry=0x1b1b140, argc=<optimized out>, vp=<optimized out>) at /home/tromey/firefox-git/hg2/js/src/proxy/Proxy.cpp:683
#42 0x00007ff4a3ebf499 in js::CallJSNative (cx=cx@entry=0x1b1b140, native=0x7ff4a3ddc260 <js::proxy_Call(JSContext*, unsigned int, JS::Value*)>, args=...) at /home/tromey/firefox-git/hg2/js/src/jscntxtinlines.h:235
#43 0x00007ff4a3eb4a81 in js::Invoke (cx=cx@entry=0x1b1b140, args=..., construct=construct@entry=js::NO_CONSTRUCT) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:432
#44 0x00007ff4a3eb5499 in js::Invoke (cx=cx@entry=0x1b1b140, thisv=..., fval=..., argc=argc@entry=1, argv=argv@entry=0x7ffe33d1a798, rval=..., rval@entry=JSVAL_VOID) at /home/tromey/firefox-git/hg2/js/src/vm/Interpreter.cpp:496
#45 0x00007ff4a3a1dc77 in js::jit::DoCallFallback (cx=0x1b1b140, frame=<optimized out>, stub_=<optimized out>, argc=<optimized out>, vp=0x7ffe33d1a788, res=...) at /home/tromey/firefox-git/hg2/js/src/jit/BaselineIC.cpp:6160

Comment 1

[Bobby Holley (:bholley)]

Need a regression window. I suspect bug 1187146 or bug 1218029.

Comment 2

[James Long (:jlongster)]

Hitting this while trying to land bug 1132501:

https://treeherder.mozilla.org/#/jobs?repo=try&revision=0986c2e5bdbe&selectedJob=14819165

Comment 3

[Tom Tromey :tromey]

I tried to reproduce this today, using my original recipe, but I could not.

I also applied the latest patch from bug 1132501 and ran the tests from
devtools/client/webide/test; this also failed to reproduce the crash.

James, do you have some other way to reproduce?

Comment 4

[James Long (:jlongster)]

On PTO now, but bug 1132501 actually does not depend on this anymore. I discovered that we were calling `unsafeSynchronize` during all `newSource` events, when we only should be calling that when we have breakpoints to set. That spins up a new event loop to synchronously wait on a promise. Calling that for all tests freaked a bunch of stuff out. I saw this error consistently on linux, you can check one of the earlier try pushes in that bug.

Fixing that call (by avoiding it) appeased a lot of weird bugs though, like this one, so I don't need this fixed anymore. That doesn't mean we shouldn't fix it :)

If you want to try to reproduce it with bug 1132501, apply the patch and go into `_addSource` in script.js and make sure it always calls `unsafeSynchronize` on the `sourceActorsCreated` promise. Maybe you can see this error locally.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Per IRC discussion w/ jryans and jlongster, duping this over to bug 1225160.