1264891 - Assertion failure: !HasListeners() (when listeners present, must keep mMatches current), at c:/Users/mozilla/debug-builds/mozilla-central/layout/style/MediaQueryList.cpp:76

Status: NEW

(Core :: Layout, defect)

Description

[Carsten Book [:Tomcat]]

found via bughunter and reproduced on a windows 7 trunk debug build

Steps to reproduce:
-> Load http://www.avira.com/en/personalized-ftu
--> Assertion failure

Assertion failure: !HasListeners() (when listeners present, must keep mMatches current), at c:/Users/mozilla/debug-builds/mozilla-central/layout/style/MediaQueryList.cpp:76
#01: mozilla::dom::WantsQueryInterface<nsMimeTypeArray>::Enabled[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x25d0b4e]
#02: mozilla::dom::GenericBindingGetter[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x327d860]
#03: js::CallJSNative[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62d4cd6]
#04: js::InternalCallOrConstruct[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62dbec5]
#05: js::InitPropertyOperation[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62dbbc6]
#06: js::Call[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62d4acf]
#07: js::CallGetter[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62d4c4e]
#08: js::TypeSet::BooleanType[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x652f323]
#09: mozilla::Forward<js::ReadBarriered<js::ObjectGroup *> >[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x651e9c3]
#10: mozilla::Move<mozilla::Vector<JS::NotableStringInfo,0,js::SystemAllocPolicy> &>[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x651f64d]
#11: js::NativeGetProperty[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x653467e]
#12: js::GetProperty[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x613511e]
#13: js::GetProperty[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x61350a8]
#14: js::GetProperty[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62d9d16]
#15: js::GetPropertyNoGC[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62d9f3a]
#16: js::InternalConstructWithProvidedThis[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62e4f4d]
#17: js::RunScript[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62f6673]
#18: js::InternalCallOrConstruct[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62dbf60]
#19: js::InitPropertyOperation[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62dbbc6]
#20: js::Call[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62d4acf]
#21: js::fun_apply[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x6102b82]
#22: js::CallJSNative[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62d4cd6]
#23: js::InternalCallOrConstruct[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62dbec5]
#24: js::InitPropertyOperation[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62dbbc6]
#25: js::CallFromStack[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62d4be0]
#26: js::jit::BaselineScript::Destroy[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x684c850]
#27: ??? (???:???)
#28: ??? (???:???)
#29: ??? (???:???)
#30: js::jit::EmitChangeICReturnAddress[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x685181d]
#31: js::jit::EnterBaselineAtBranch[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x6851e1d]
#32: js::InternalConstructWithProvidedThis[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62dd155]
#33: js::RunScript[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62f6673]
#34: js::InternalCallOrConstruct[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62dbf60]
#35: js::InitPropertyOperation[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62dbbc6]
#36: js::Call[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x62d4acf]
#37: JS::Call[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x61e7775]
#38: mozilla::dom::EventListener::HandleEvent[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x30742e4]
#39: mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget *>[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x35cdcae]
#40: mozilla::EventListenerManager::HandleEventSubType[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x35e4da8]
#41: mozilla::EventListenerManager::HandleEventInternal[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x35e4909]
#42: mozilla::EventListenerManager::HandleEvent[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x35bb21a]
#43: mozilla::EventTargetChainItem::HandleEvent[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x35bb3cc]
#44: mozilla::EventTargetChainItem::HandleEventTargetChain[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x35bb61b]
#45: mozilla::EventDispatcher::Dispatch[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x35afa80]
#46: mozilla::EventDispatcher::DispatchDOMEvent[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x35b00c0]
#47: nsINode::DispatchEvent[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x226b3b4]
#48: nsContentUtils::DispatchEvent[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1f939f0]
#49: nsContentUtils::DispatchTrustedEvent[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x1f93bd6]
#50: nsDocument::DispatchContentLoadedEvents[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x21da2e9]
#51: ??$applyImpl@VnsDocument@@P81@AEXXZ$$$V$S@?$nsRunnableMethodArguments@$$$V@@SAXPAVnsDocument@@P81@AEXXZAAV?$Tuple@$$$V@mozilla@@U?$IndexSequence@$S@3@@Z[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x21a529c]
#52: ??$apply@VnsDocument@@P81@AEXXZ@?$nsRunnableMethodArguments@$$$V@@QAEXPAVnsDocument@@P81@AEXXZ@Z[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x21a5238]
#53: ?Run@?$nsRunnableMethodImpl@P8nsDocument@@AEXXZ$00$$$V@@UAG?AW4nsresult@@XZ[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x222a7a4]
#54: nsThread::ProcessNextEvent[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x5f3db7]
#55: NS_ProcessNextEvent[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x65c242]
#56: mozilla::ipc::MessagePump::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xe51e69]
#57: MessageLoop::RunInternal[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xde37cd]
#58: MessageLoop::RunHandler[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xde3742]
#59: MessageLoop::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0xde333d]
#60: nsBaseAppShell::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x436c940]
#61: nsAppShell::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x4416da3]
#62: nsAppStartup::Run[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x5462c2f]
#63: XREMain::XRE_mainRun[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x5508b1a]
#64: XREMain::XRE_main[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x5505797]
#65: XRE_main[c:\Users\mozilla\debug-builds\mozilla-central\firefox-debug\dist\bin\xul.dll +0x550b40a]
#66: do_main (c:\users\mozilla\debug-builds\mozilla-central\browser\app\nsbrowserapp.cpp:220)
#67: NS_internal_main (c:\users\mozilla\debug-builds\mozilla-central\browser\app\nsbrowserapp.cpp:360)
#68: wmain (c:\users\mozilla\debug-builds\mozilla-central\toolkit\xre\nswindowswmain.cpp:135)
#69: __tmainCRTStartup (f:\dd\vctools\crt\crtw32\startup\crt0.c:255)
#70: BaseThreadInitThunk[C:\Windows\system32\kernel32.dll +0x4ef1c]

Comment 1

[Carsten Book [:Tomcat]]

Cameron, is this something for you ?

Comment 2

[Carsten Book [:Tomcat]]

another site is http://support.videotron.com/residential/mobile/devices/blackberry-bold-9900

Comment 3

[Julian Seward [:jseward]]

dbaron suggested that this might possibly be related to bug 1288393.

Comment 4

[Carsten Book [:Tomcat]]

Attachment: stack

still reproducible with a current windows tinderbox trunk debug build here : http://network.cbc-eg.com/

Comment 5

[Carsten Book [:Tomcat]]

[Tracking Requested - why for this release]:

Bughunter found on real websites trunk -> beta - also it seems multiple sites.

Jet, can you help find someone who could take a look at this ?

Comment 6

[Jet Villegas (inactive)]

Attachment: Diagnostic Patch

I added 2 diagnostic asserts to try and narrow this down. In the test page, the second assert fires (No PresContext for a document that's adding a Listener for Media Query list changes.)

Comment 7

[Jet Villegas (inactive)]

It seems we shouldn't allow Listeners to get added when there isn't a PresContext for the Document. I don't see anything good from allowing that to happen, since all Matches() calls will be invalid in that case. We can guard against that in MediaQueryList::AddListener(). bz: wdyt?

Comment 8

[Boris Zbarsky [:bzbarsky]]

> It seems we shouldn't allow Listeners to get added when there isn't a PresContext for the Document.

Not having a prescontext is a Gecko-internal state that has no counterpart in specs and shouldn't be exposed to web authors in any way, imo.

Note that I'm trying to make this case go away altogether in bug 548397, but it's pretty orange on try so far....

In the meantime, it might be worth working around this state in the media query list code, if it's not too difficult.

Comment 9

[Jet Villegas (inactive)]

(In reply to Carsten Book [:Tomcat] from comment #5)
> [Tracking Requested - why for this release]:
> 
> Bughunter found on real websites trunk -> beta - also it seems multiple
> sites.
> 
> Jet, can you help find someone who could take a look at this ?

It looks like the ASSERT in this bug is flagging a case that is allowable based on comment 8. We can look at ways to relax the ASSERT, but it seems OK in this case.

Comment 10

[Boris Zbarsky [:bzbarsky]]

It would help to have a testcase attached to this bug...

But yes, asserting that !HasListeners() || !prescontext would make sense.

Comment 11

[Liz Henry (:lizzard) (relman/hg->git project)]

Seems unlikely we will fix this for 50. Jet, is this something you want relman to track?

Comment 12

[Jet Villegas (inactive)]

(In reply to Liz Henry (:lizzard) (needinfo? me) from comment #11)
> Seems unlikely we will fix this for 50. Jet, is this something you want
> relman to track?

We don't need to keep tracking this one. This is debug-only and won't affect releases.

Comment 13

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Untracked for 50 as well.

Comment 14

[Carsten Book [:Tomcat]]

a new site that bughunter found is https://app.reviewpro.com/reviews/tracking?dataGrouping=daily&fd=2016-01-01&indexType=GRI&lang=en&pid=111515&prevFd=2015-01-01&prevTd=2015-10-31&td=2016-10-31

Comment 16

[Bob Clary [:bc] (inactive)]

Note we are in the process of retesting the urls we have crashed on since Jan 1. This assertion is the most common crash we can reproduce. We don't see corresponding opt crashes however the pages . We haven't finished completely yet but so far we have seen:

http://searchfox.org/mozilla-central/source/layout/style/MediaQueryList.cpp#75
has fired on 108 urls on Beta, Aurora, Nightly for Windows 32bit, 64bit and Linux 64bit.

I just reproduced this on Fedora 25 64bit for

http://network.cbc-eg.com/topic/drama/17696
http://www.monoprice.com/category/pages/7

bool
MediaQueryList::Matches()
{
  if (!mMatchesValid) {
=>  MOZ_ASSERT(!HasListeners(),
               "when listeners present, must keep mMatches current");
    RecomputeMatches();
  }

  return mMatches;
}

 0  xul.dll!mozilla::dom::MediaQueryList::Matches() [MediaQueryList.cpp:3154da520af5 : 75 + 0x1b]
 1  xul.dll!mozilla::dom::MediaQueryListBinding::get_matches [MediaQueryListBinding.cpp:3154da520af5 : 85 + 0x8]
 2  xul.dll!mozilla::dom::GenericBindingGetter(JSContext *,unsigned int,JS::Value *) [BindingUtils.cpp:3154da520af5 : 2843 + 0x14]
 3  xul.dll!js::CallJSNative(JSContext *,bool (*)(JSContext *,unsigned int,JS::Value *),JS::CallArgs const &) [jscntxtinlines.h:3154da520af5 : 282 + 0x10]
 4  xul.dll!js::InternalCallOrConstruct(JSContext *,JS::CallArgs const &,js::MaybeConstruct) [Interpreter.cpp:3154da520af5 : 448 + 0x13]
 5  xul.dll!js::CallGetter(JSContext *,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::MutableHandle<JS::Value>) [Interpreter.cpp:3154da520af5 : 627 + 0x42]

===

http://searchfox.org/mozilla-central/source/layout/style/MediaQueryList.cpp#93
has fired on 2 urls on Beta, Aurora, Nightly for Windows 64bit and Linux 64bit.

I just reproduced this with a recent Nightly Build on Fedora 25 64bit.

https://deepenglish.com/2017/02/van-goghs-ear-reborn/
http://www.i-study.co.uk/Economics/Basic_Economic_Problem.html

void
MediaQueryList::AddListener(MediaQueryListListener& aListener)
{
  if (!HasListeners()) {
    // When we have listeners, the pres context owns a reference to
    // this.  This is a cyclic reference that can only be broken by
    // cycle collection.
    NS_ADDREF_THIS();
  }

  if (!mMatchesValid) {
=>  MOZ_ASSERT(!HasListeners(),
               "when listeners present, must keep mMatches current");
    RecomputeMatches();
  }

  for (uint32_t i = 0; i < mCallbacks.Length(); ++i) {
    if (aListener == *mCallbacks[i]) {
      // Already registered
      return;
    }
  }

  if (!mCallbacks.AppendElement(&aListener, fallible)) {
    if (!HasListeners()) {
      // Append failed; undo the AddRef above.
      NS_RELEASE_THIS();
    }
  }
}

 0  xul.dll!mozilla::dom::MediaQueryList::AddListener(mozilla::dom::MediaQueryListListener &) [MediaQueryList.cpp:3154da520af5 : 94 + 0x14]
 1  xul.dll!mozilla::dom::MediaQueryListBinding::addListener [MediaQueryListBinding.cpp:3154da520af5 : 130 + 0x11]
 2  xul.dll!mozilla::dom::MediaKeysBinding::setServerCertificate [MediaKeysBinding.cpp:3154da520af5 : 153 + 0x20]
 3  xul.dll!mozilla::dom::UnwrapDOMObject<void>(JSObject *) [BindingUtils.h:3154da520af5 : 138 + 0x8]
 4  xul.dll!mozilla::dom::ToJSValue<mozilla::dom::Exception>(JSContext *,mozilla::dom::Exception &,JS::MutableHandle<JS::Value>) [ToJSValue.h:3154da520af5 : 150 + 0xb]
 5  xul.dll!mozilla::dom::GenericBindingMethod(JSContext *,unsigned int,JS::Value *) [BindingUtils.cpp:3154da520af5 : 2953 + 0x17]

Beta, Aurora and Nightly also each have additional distinct stacks for these same two urls.

While the number of domains for these urls is fairly limited, we've crashed with this assertion over 1800 times since our retest began last night. If we aren't going to fix this in a timely manner, can we just make these non-fatal assertions?

Comment 17

[Julien Cristau [:jcristau]]

Too late for firefox 52, mass-wontfix.

Comment 18

[Bob Clary [:bc] (inactive)]

fyi, this is still reproducible on Firefox 57 on Windows and Linux with this url. During a retest of crashing urls, bughunter reproduced this on 67 urls total on the following domains:

builder2.fidelis.art.br
deepenglish.com
live.gearsofwar.com
maxflix.org
network.cbc-eg.com
ramadan.cbc-eg.com
seriesparaassistironline.org
shop.layer-grosshandel.de
store.hihonor.com
www.avira.com
www.bankrate.com
www.bosch.com
www.cbc-eg.com
www.cincinnatibell.com
www.genemedics.com
www.internationaldriveorlando.com
www.investinganswers.com
www.i-study.co.uk
www.monoprice.com
www.partirpascher.com
www.prensa-latina.cu
www.uvic.ca
www.youthhostel.ch
xueshu.baidu.com