127315 - ASSERTION: QueryInterface needed: 'query_result.get() == mRawPtr'

Status: RESOLVED DUPLICATE of bug 121548

(Core :: XUL, defect)

Description

[timeless]

cvs build from lunch(eastern time)
(gdb) p mRawPtr
$2 = (nsIDOMNode *) 0x91b7f00
(gdb) call query_result.get()
$3 = (nsDerivedSafe<nsIDOMNode> *) 0x91ab504

#2  0x2831b079 in nsDebug::Assertion (aStr=0x2932d545 "QueryInterface needed", aExpr=0x2932d527 "query_result.get() == mRawPtr",
    aFile=0x2932d500 "../../../dist/include/xpcom/nsCOMPtr.h", aLine=501) at /home/timeless/mozilla/xpcom/glue/nsDebug.cpp:291
#3  0x29284572 in nsCOMPtr<nsIDOMNode>::Assert_NoQueryNeeded (this=0xbfbfb61c) at ../../../dist/include/xpcom/nsCOMPtr.h:501
#4  0x292935e1 in nsCOMPtr<nsIDOMNode>::nsCOMPtr (this=0xbfbfb61c, aRawPtr=0x91b7f00) at ../../../dist/include/xpcom/nsCOMPtr.h:536
#5  0x290d69bf in nsXULElement::IsAncestor (aParentNode=0x91abe84, aChildNode=0x91b7f00)
    at /home/timeless/mozilla/content/xul/content/src/nsXULElement.cpp:4433
#6  0x290cb9ae in nsXULElement::RemoveChildAt (this=0x91ab540, aIndex=0, aNotify=1)
    at /home/timeless/mozilla/content/xul/content/src/nsXULElement.cpp:2402
#7  0x290c6251 in nsXULElement::RemoveChild (this=0x91ab540, aOldChild=0x91abe84, aReturn=0xbfbfbb88)
    at /home/timeless/mozilla/content/xul/content/src/nsXULElement.cpp:1129
#8  0x282f720c in XPTC_InvokeByIndex (that=0x91ab544, methodIndex=17, paramCount=2, params=0xbfbfbb78)
    at /home/timeless/mozilla/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_unixish_x86.cpp:153
#9  0x288efba5 in XPCWrappedNative::CallMethod (ccx=@0xbfbfbc30, mode=CALL_METHOD)
    at /home/timeless/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp:1998
#10 0x288f8d0e in XPC_WN_CallMethod (cx=0x8ab7200, obj=0x91367e0, argc=1, argv=0x8bb141c, vp=0xbfbfbd64)
    at /home/timeless/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1266
#11 0x2817647a in js_Invoke (cx=0x8ab7200, argc=1, flags=0) at /home/timeless/mozilla/js/src/jsinterp.c:832
#12 0x281856be in js_Interpret (cx=0x8ab7200, result=0xbfbfc740) at /home/timeless/mozilla/js/src/jsinterp.c:2802
#13 0x281764f8 in js_Invoke (cx=0x8ab7200, argc=1, flags=2) at /home/timeless/mozilla/js/src/jsinterp.c:849
#14 0x2817686f in js_InternalInvoke (cx=0x8ab7200, obj=0x9136830, fval=153166296, flags=0, argc=1, argv=0xbfbfcc24, rval=0xbfbfc908)
    at /home/timeless/mozilla/js/src/jsinterp.c:924
#15 0x28145a95 in JS_CallFunctionValue (cx=0x8ab7200, obj=0x9136830, fval=153166296, argc=1, argv=0xbfbfcc24, rval=0xbfbfc908)
    at /home/timeless/mozilla/js/src/jsapi.c:3415
#16 0x297f1590 in nsJSContext::CallEventHandler (this=0x87c1f00, aTarget=0x9136830, aHandler=0x92121d8, argc=1, argv=0xbfbfcc24,
    aBoolResult=0xbfbfca44, aReverseReturnResult=0) at /home/timeless/mozilla/dom/src/base/nsJSEnvironment.cpp:1015
#17 0x2983aaab in nsJSEventListener::HandleEvent (this=0x90b7d60, aEvent=0x92f2008)
    at /home/timeless/mozilla/dom/src/events/nsJSEventListener.cpp:180
#18 0x28f4a361 in nsEventListenerManager::HandleEventSubType (this=0x91abf40, aListenerStruct=0x904d710, aDOMEvent=0x92f2008,
    aCurrentTarget=0x91abf08, aSubType=1, aPhaseFlags=2) at /home/timeless/mozilla/content/events/src/nsEventListenerManager.cpp:1212
#19 0x28f4c3f0 in nsEventListenerManager::HandleEvent (this=0x91abf40, aPresContext=0x8b39800, aEvent=0xbfbff330,
    aDOMEvent=0xbfbfea38, aCurrentTarget=0x91abf08, aFlags=2, aEventStatus=0xbfbfefec)
    at /home/timeless/mozilla/content/events/src/nsEventListenerManager.cpp:1675
#20 0x290d15fc in nsXULElement::HandleDOMEvent (this=0x91abf00, aPresContext=0x8b39800, aEvent=0xbfbff330, aDOMEvent=0xbfbfea38,
    aFlags=2, aEventStatus=0xbfbfefec) at /home/timeless/mozilla/content/xul/content/src/nsXULElement.cpp:3452
#21 0x290d17ed in nsXULElement::HandleDOMEvent (this=0x91b3b80, aPresContext=0x8b39800, aEvent=0xbfbff330, aDOMEvent=0xbfbfea38,
    aFlags=2, aEventStatus=0xbfbfefec) at /home/timeless/mozilla/content/xul/content/src/nsXULElement.cpp:3470
#22 0x290d17ed in nsXULElement::HandleDOMEvent (this=0x91b3c00, aPresContext=0x8b39800, aEvent=0xbfbff330, aDOMEvent=0xbfbfea38,
    aFlags=2, aEventStatus=0xbfbfefec) at /home/timeless/mozilla/content/xul/content/src/nsXULElement.cpp:3470
#23 0x291dd53a in nsGenericElement::HandleDOMEvent (this=0x9168880, aPresContext=0x8b39800, aEvent=0xbfbff330, aDOMEvent=0xbfbfea38,
    aFlags=1, aEventStatus=0xbfbfefec) at /home/timeless/mozilla/content/base/src/nsGenericElement.cpp:1661
#24 0x28fad13f in nsHTMLInputElement::HandleDOMEvent (this=0x9168880, aPresContext=0x8b39800, aEvent=0xbfbff330, aDOMEvent=0x0,
    aFlags=1, aEventStatus=0xbfbfefec) at /home/timeless/mozilla/content/html/content/src/nsHTMLInputElement.cpp:1213
#25 0x29e2984d in PresShell::HandleEventInternal (this=0x8b39c00, aEvent=0xbfbff330, aView=0x906d180, aFlags=1, aStatus=0xbfbfefec)
    at /home/timeless/mozilla/layout/html/base/src/nsPresShell.cpp:6003
#26 0x29e29289 in PresShell::HandleEvent (this=0x8b39c00, aView=0x906d180, aEvent=0xbfbff330, aEventStatus=0xbfbfefec, aForceHandle=0,
    aHandled=@0xbfbfef84) at /home/timeless/mozilla/layout/html/base/src/nsPresShell.cpp:5926
#27 0x2a1dcf2f in nsViewManager::HandleEvent (this=0x8b6f200, aView=0x8f9a800, aEvent=0xbfbff330, aCaptured=0)
    at /home/timeless/mozilla/view/src/nsViewManager.cpp:2041
#28 0x2a1cd255 in nsView::HandleEvent (this=0x8f9a800, aVM=0x8b6f200, aEvent=0xbfbff330, aCaptured=0)
    at /home/timeless/mozilla/view/src/nsView.cpp:305
#29 0x2a1dc561 in nsViewManager::DispatchEvent (this=0x8b6f200, aEvent=0xbfbff330, aStatus=0xbfbff178)
    at /home/timeless/mozilla/view/src/nsViewManager.cpp:1857
#30 0x2a1cc906 in HandleEvent (aEvent=0xbfbff330) at /home/timeless/mozilla/view/src/nsView.cpp:80
#31 0x295bd348 in nsWidget::DispatchEvent (this=0x8ed8000, aEvent=0xbfbff330, aStatus=@0xbfbff268)
    at /home/timeless/mozilla/widget/src/gtk/nsWidget.cpp:1376
#32 0x295bced9 in nsWidget::DispatchWindowEvent (this=0x8ed8000, event=0xbfbff330)
    at /home/timeless/mozilla/widget/src/gtk/nsWidget.cpp:1264
#33 0x295ba2c9 in nsWidget::OnInput (this=0x8ed8000, aEvent=@0xbfbff330) at /home/timeless/mozilla/widget/src/gtk/nsWidget.cpp:108
#34 0x295e1719 in nsWidget::OnKey (this=0x8ed8000, aEvent=@0xbfbff330) at /home/timeless/mozilla/widget/src/gtk/nsWidget.h:204

Comment 1

[Chris Lyon]

*** Bug 127316 has been marked as a duplicate of this bug. ***

Comment 2

[timeless]

steps:
1. load a news group
2. create a new message
3. click the second address line, press backspace
or double click  the addressing area (doesn't always work, sometimes i've gotten the addressing dialog)

Comment 3

[timeless]

[wood theme] if you go to mail news account settings and collapse a category, you get one assert for each row being collapsed (4/5 for news/imap respectively) raising severity

Comment 4

[Brendan Eich [:brendan]]

I don't think this is a hyatt bug.  Might it be outliner?

timeless: what does the vtbl of the instance that needs QI look like?

/be

Comment 5

[Jan Varga [:janv]]

mail news account settings use old tree

Comment 6

[timeless]

(gdb) p mRawPtr
$1 = (nsIDOMNode *) 0x9004e80
(gdb) call query_result.get()
$5 = (nsDerivedSafe<nsIDOMNode> *) 0x8e9ffc4
(gdb)  x/wa *(void**) mRawPtr
0x2893ad60 <_vt$14nsXPCWrappedJS>:      0x0
(gdb)  x/wa *(void**) $5
0x2945f980 <_vt$12nsXULElement$16nsIDOMXULElement>:     0xfffc
(gdb) p *(nsXPCWrappedJS*)mRawPtr
$12 = {<nsXPTCStubBase> = {<nsISupports> = {
      _vptr$ = 0x2893ad60}, <No data fields>}, <nsIXPConnectWrappedJS> = {<nsIXPConnectJSObjectHolder> = {<nsISupports> = {
        _vptr$ = 0x2893ad00}, <No data fields>}, <No data fields>}, <nsSupportsWeakReference> = {<nsISupportsWeakReference> = {<nsISuppo
rts> = {_vptr$ = 0x2893acc0}, <No data fields>}, mProxy = 0x0}, <nsIPropertyBag> = {<nsISupports> = {
      _vptr$ = 0x2893ac80}, <No data fields>}, mRefCnt = 4, _mOwningThread = 0x80b7380, mJSObj = 0x8fa7ca8, mClass = 0x8e1e940,
  mRoot = 0x9004e80, mNext = 0x0, mOuter = 0x8e9ffc0}
(gdb) p *(nsXULElement*)$5
$14 = {<nsIXULContent> = {<nsIXMLContent> = {<nsIStyledContent> = {<nsIContent> = {<nsISupports> = {
            _vptr$ = 0x2945f980}, <No data fields>}, <No data fields>}, <No data fields>}, <No data fields>}, <nsIDOMXULElement> = {<nsI
DOMElement> = {<nsIDOMNode> = {<nsISupports> = {
          _vptr$ = 0x2945f920}, <No data fields>}, <No data fields>}, <No data fields>}, <nsIDOMEventReceiver> = {<nsIDOMEventTarget> =
{<nsISupports> = {_vptr$ = 0x2945f8e0}, <No data fields>}, <No data fields>}, <nsIScriptEventHandlerOwner> = {<nsISupports> = {
      _vptr$ = 0x2945f8a0}, <No data fields>}, <nsIChromeEventHandler> = {<nsISupports> = {_vptr$ = 0x12}, <No data fields>},
  static gRefCnt = 3363, static gRDFService = 0x811c500, static gNameSpaceManager = 0x831c4b0, static kNameSpaceID_RDF = 10,
  static kNameSpaceID_XUL = 8, mRefCnt = 134968192, _mOwningThread = 0x0, mPrototype = 0x8b7e000, mDocument = 0x8e2d5c0,
  mParent = 0x8f44341, mChildren = {mChildren = 0x8f919c0}, mListenerManager = {mRawPtr = 0x0}, mBindingParent = 0x8f6ef70,
  mSlots = 0x0, static gXBLService = 0x0}

Comment 7

[David Bradley]

Doesn't this stem from the use of dont_QueryInterface? In this case, aChildNode
is a wrapped JS object, and I don't think that's going to fly.

PRBool
nsXULElement::IsAncestor(nsIDOMNode* aParentNode, nsIDOMNode* aChildNode)
{
  nsCOMPtr<nsIDOMNode> parent = dont_QueryInterface(aChildNode);

Comment 8

[timeless]

fwiw this feels like bug 121548 so feel free to dupe it.

yes perhaps they just need to abandon their dontquery approach in light of the facts.

brendan: i'm giving this bug back to hyatt.

Comment 9

[Brendan Eich [:brendan]]

hyatt's so not going to look at this bug, it needs to be reassigned and fixed. 
I am off for a week starting yesterday, myself.  Either timeless or dbradley or
varga is good enough to patch the dont_QI into a do_QI (and look for and fix all
other such naive, pre-xpcdom dont_QI abusages), or trudelle will have to crack
the whip.

Timeless, you wondered what you could do to help 0.9.9 and 1.0 -- here's a bug
you could help, and it even bit you first (has anyone else seen it?).  Giving it
back to you, give it to trudelle if you don't think you can fix it.  Get the fix
into 0.9.9 if you can persuade drivers to take it, once tested and r=/sr=d.

/be

Comment 10

[Blake Ross]

I see this also.

Comment 11

[timeless]

Attachment: dont=>do

Comment 12

[Jan Varga [:janv]]

Comment on attachment 71426 [details] [diff] [review]
dont=>do

r=varga
I wonder why it was done that way

Comment 13

[Peter Trudelle]

what about the 'all other such' Brendan mentioned?

Comment 14

[John Bandhauer]

*Before* this lands someone need to investigate why nsXULElement::IsAncestor is
being called with a param that is typed as nsIDOMNode* but has apparently not
been properly QI'd to that interface. It is an error *elsewhere* to be making
that assumption.

Comment 15

[John Bandhauer]

Comment on attachment 71426 [details] [diff] [review]
dont=>do

no bandaids.

Comment 16

[timeless]

*** This bug has been marked as a duplicate of 121548 ***