1336988 - Crash in JSAutoCompartment::JSAutoCompartment | mozilla::dom::CallbackObjectHolderBase::ToXPCOMCallback

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-c87b6e5a-4049-4668-a11e-517642170206.
=============================================================

Seen while looking at Aurora crash stats - this crash is present on nightly as well: http://bit.ly/2kK4blD. On Aurora crashes started with the 20170204004003 build.

Possible regression range: https://hg.mozilla.org/releases/mozilla-aurora/pushloghtml?fromchange=ed726703c08c7a0398d349efaded8bdea25c46ff&tochange=38f8808782c3209051b97de2ae3ea8c6a535e01a

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Regression from bug 1273251 I think.

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

(I think the regression range isn't right)

Comment 3

[Marcia Knous [:marcia]]

(In reply to Olli Pettay [:smaug] from comment #2)
> (I think the regression range isn't right)

Thanks smaug - you are right - the Socorro search did not pick up the all the crashes. The correct regression window on mozilla central is: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=96cb95af530477edb66ae48d98c18533476e57bb&tochange=aa3e49299a3aa5cb0db570532e3df9e75d30c2d1 which has that bug in the range.

Comment 4

[Kris Maglione [:kmag]]

Attachment: Bug 1336988: Correctly handle dead callback objects when iterating over event listeners.

Review commit: https://reviewboard.mozilla.org/r/110164/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/110164/

Comment 5

[Peter Van der Beken [:peterv]]

Comment on attachment 8834091 [details]
Bug 1336988: Correctly handle dead callback objects when iterating over event listeners.

https://reviewboard.mozilla.org/r/110164/#review113396

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/db46b66a8c3b
Correctly handle dead callback objects when iterating over event listeners. r=peterv

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/db46b66a8c3b

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Please request Aurora approval on this when you get a chance.

Comment 9

[Kris Maglione [:kmag]]

Comment on attachment 8834091 [details]
Bug 1336988: Correctly handle dead callback objects when iterating over event listeners.

Approval Request Comment
[Feature/Bug causing the regression]: Bug 1273251
[User impact if declined]: This bug causes crashes in certain corner cases when extensions are being debugged.
[Is this code covered by automated tests?]: Yes.
[Has the fix been verified in Nightly?]: No.
[Needs manual test from QE? If yes, steps to reproduce]: No, automated tests should be sufficient.
[List of other uplifts needed for the feature/fix]: None.
[Is the change risky?]: Low-risk.
[Why is the change risky/not risky?]: This simply adds null checks to fix the handling of dead event listeners in certain corner cases.
[String changes made/needed]: None.

Comment 10

[Gerry Chang [:gchang]]

Comment on attachment 8834091 [details]
Bug 1336988: Correctly handle dead callback objects when iterating over event listeners.

Fix a crash. Aurora53+.

Comment 11

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/8750d50052ad