1304702 - Assertion failure: mStateData.mResponse.isObject() && JS_IsArrayBufferObject(&mStateData.mResponse.toObject()), at XMLHttpRequestWorker.cpp:2440

Status: RESOLVED DUPLICATE of bug 1300552

(Core :: DOM: Core & HTML, defect)

Description

[Carsten Book [:Tomcat]]

Attachment: bughunter stack

found via bughunter and reproduced on the latest windows trunk debug tinderbox build. Also seems to affect aurora (51) debug only

Steps to reproduce:
-> https://www.docdroid.net/h2an/prima-1999-pokemon-red-blue.pdf.html
--> Assertion failure

Assertion failure: mStateData.mResponse.isObject() && JS_IsArrayBufferObject(&mStateData.mResponse.toObject()), at c:/builds/moz2_slave/m-cen-w32-d-000000000000000000/build/src/dom/xhr/XMLHttpRequestWorker.cpp:2440

Comment 1

[Carsten Book [:Tomcat]]

[Tracking Requested - why for this release]:

bughunter, live website found

Comment 2

[Gerry Chang [:gchang]]

Track for 51+/52+ as this is found in live website.

Comment 3

[Gerry Chang [:gchang]]

Hi :hsinyi,
Can you help shed some light here?

Comment 4

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Shawn, please help here! Thanks!

Comment 5

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

I've also tried to reproduce it on Linux with mozilla-central. Hit MOZ_CRASH.

[Parent 18910] WARNING: We should have hit the document element...: file /home/shawnjohnjr/code/mozilla-inbound/layout/xul/BoxObject.cpp, line 175
IPDL protocol error: could not lookup id for PSendStream
IPDL protocol error: Error deserializing Union type
[Parent 18910] ###!!! ASSERTION: IPDL error [PContentParent]: "Error deserializing Union type". Intentionally crashing.: 'Error', file /home/shawnjohnjr/code/mozilla-inbound/ipc/glue/ProtocolUtils.cpp, line 305
Hit MOZ_CRASH(IPC FatalError in the parent process!) at /home/shawnjohnjr/code/mozilla-inbound/ipc/glue/ProtocolUtils.cpp:312

Comment 6

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

(In reply to Shawn Huang [:shawnjohnjr] from comment #5)
> I've also tried to reproduce it on Linux with mozilla-central. Hit MOZ_CRASH.
> 
> [Parent 18910] WARNING: We should have hit the document element...: file
> /home/shawnjohnjr/code/mozilla-inbound/layout/xul/BoxObject.cpp, line 175
> IPDL protocol error: could not lookup id for PSendStream
> IPDL protocol error: Error deserializing Union type
> [Parent 18910] ###!!! ASSERTION: IPDL error [PContentParent]: "Error
> deserializing Union type". Intentionally crashing.: 'Error', file
> /home/shawnjohnjr/code/mozilla-inbound/ipc/glue/ProtocolUtils.cpp, line 305
> Hit MOZ_CRASH(IPC FatalError in the parent process!) at
> /home/shawnjohnjr/code/mozilla-inbound/ipc/glue/ProtocolUtils.cpp:312

Maybe this is an another different bug.

Comment 7

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

It looks like this line doesn't satisfy. 
|JS_IsArrayBufferObject(&mStateData.mResponse.toObject())|

#0  0x00007f3bb346bb35 in mozilla::dom::XMLHttpRequestWorker::UpdateState (this=this@entry=0x7f3b943f0700, aStateData=..., aUseCachedArrayBufferResponse=<optimized out>)
    at /home/shawnjohnjr/code/mozilla-aroura/mozilla-aurora/dom/xhr/XMLHttpRequestWorker.cpp:2440
#1  0x00007f3bb346e562 in mozilla::dom::(anonymous namespace)::EventRunnable::WorkerRun (this=0x7f3b9223a240, aCx=0x7f3b91912000, aWorkerPrivate=<optimized out>)
    at /home/shawnjohnjr/code/mozilla-aroura/mozilla-aurora/dom/xhr/XMLHttpRequestWorker.cpp:1311

Comment 8

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

When |XMLHttpRequestMainThread::GetResponseText| get called [1] in |PreDispatch|, in GetResponseText it checks mResponseType, since mResponseType is ArrayBuffer, so NS_ERROR_DOM_INVALID_STATE_XHR_HAS_WRONG_RESPONSETYPE_FOR_RESPONSETEXT returns. Since |mResponse| is never been assigned (JS::UndefinedValue()), we hit the MOZ_ASSERT.


[1] http://searchfox.org/mozilla-central/source/dom/xhr/XMLHttpRequestWorker.cpp#1133
[2] http://searchfox.org/mozilla-central/source/dom/xhr/XMLHttpRequestMainThread.cpp#598

Comment 9

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

Using the latest aurora code, I can't reproduce this bug. I will try to find which patch fix the problem.

Comment 10

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

(In reply to Shawn Huang [:shawnjohnjr] from comment #5)
> I've also tried to reproduce it on Linux with mozilla-central. Hit MOZ_CRASH.
> 
> [Parent 18910] WARNING: We should have hit the document element...: file
> /home/shawnjohnjr/code/mozilla-inbound/layout/xul/BoxObject.cpp, line 175
> IPDL protocol error: could not lookup id for PSendStream
> IPDL protocol error: Error deserializing Union type
> [Parent 18910] ###!!! ASSERTION: IPDL error [PContentParent]: "Error
> deserializing Union type". Intentionally crashing.: 'Error', file
> /home/shawnjohnjr/code/mozilla-inbound/ipc/glue/ProtocolUtils.cpp, line 305
> Hit MOZ_CRASH(IPC FatalError in the parent process!) at
> /home/shawnjohnjr/code/mozilla-inbound/ipc/glue/ProtocolUtils.cpp:312

The latest mozilla-central also fixed the ipc problem.

Comment 11

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

Oh, after bisecting, so this bug get fixed already by this patch.
Bug 1300552 - XMLHttpRequestWorker::EventRunnable must update stateData also after an abort(), r=ehsan a=ritu


See: 
Bug 1300552 - Assertion failure: mStateData.mResponse.isObject() && JS_IsArrayBufferObject(&mStateData.mResponse.toObject()), at c:/builds/moz2_slave/m-cen-w64-d-000000000000000000/build/src/dom/xhr/XMLHttpRequestWorker.cpp:2425

Comment 12

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Thanks for the updates.