Closed Bug 1281730 Opened 8 years ago Closed 8 years ago

Workers and setTimeout ⇒ "Assertion failure: !IsNull() (Cannot compute with a null value)" within nsGlobalWindow::InsertTimeoutIntoList

Categories

(Core :: DOM: Core & HTML, defect, P3)

defect

Tracking

()

RESOLVED FIXED
mozilla50
Tracking Status
firefox50 --- fixed

People

(Reporter: jruderman, Assigned: bkelly)

Details

(Keywords: assertion, testcase)

Attachments

(3 files)

Attached file testcase
Assertion failure: !IsNull() (Cannot compute with a null value), at TimeStamp.h:551
Attached file stack
Ben, WDYT about this assertion?
Flags: needinfo?(bkelly)
Priority: -- → P3
I haven't really looked at this yet, but I can tell you opening the attached test case leaks its window.
So the issue here is that the timers were suspended on the window.  In nsGlobalWindow::ResumeTimers() we thaw workers and then fixup the timer instances.  With this test case, though, there is a pending message event from the worker which immediately calls setTimeout().  This then blows up because the timer objects still are in their frozen state with mValues of 0.

I think the safest thing to do here is to simply restore the timers before thawing the workers.  Any timer initialized in this process should run in a new runnable on the main thread and therefore won't execute before the worker thaw process.

I also considered making the worker thaw process asynchronous, but there are comments about strict ordering of the frozen events vs the worker thread running, so that did not seem as safe.

This patch fixes the issue locally for me.  I'll do a try run next to verify it doesn't break something else.
Assignee: nobody → bkelly
Status: NEW → ASSIGNED
Flags: needinfo?(bkelly)
Attachment #8767276 - Flags: review?(khuey)
Pushed by bkelly@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/98f89b579438
Restore timeouts before thawing workers to avoid running script on frozen timers. r=khuey
https://hg.mozilla.org/mozilla-central/rev/98f89b579438
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla50
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: