1348220 - Crash when custom element lifecycle callback is invoked (dom.webcomponents.customelements.enabled=true)

Status: RESOLVED INVALID

(Core :: DOM: Core & HTML, defect)

Description

[Edgar Chen [:edgar]]

Attachment: test.html

Assertion failure: js::IsObjectInContextCompartment(aGivenProto, aCx), at /Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dom/bindings/HTMLElementBinding.cpp:8017
#01: mozilla::dom::HTMLElementBinding::Wrap(JSContext*, nsGenericHTMLElement*, nsWrapperCache*, JS::Handle<JSObject*>, JS::MutableHandle<JSObject*>)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x30e19bb]
#02: JSObject* mozilla::dom::HTMLElementBinding::Wrap<mozilla::dom::HTMLElement>(JSContext*, mozilla::dom::HTMLElement*, JS::Handle<JSObject*>)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3776298]
#03: mozilla::dom::HTMLElement::WrapNode(JSContext*, JS::Handle<JSObject*>)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x37761ed]
#04: nsINode::WrapObject(JSContext*, JS::Handle<JSObject*>)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x231caaa]
#05: mozilla::dom::Element::WrapObject(JSContext*, JS::Handle<JSObject*>)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x21116f8]
#06: bool mozilla::dom::binding_detail::DoGetOrCreateDOMReflector<mozilla::dom::Element, (mozilla::dom::binding_detail::GetOrCreateReflectorWrapBehavior)0>(JSContext*, mozilla::dom::Element*, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20f6e7a]
#07: bool mozilla::dom::GetOrCreateDOMReflector<mozilla::dom::Element>(JSContext*, mozilla::dom::Element*, JS::MutableHandle<JS::Value>, JS::Handle<JSObject*>)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20f6cbd]
#08: mozilla::dom::GetOrCreateDOMReflectorHelper<mozilla::dom::Element, false>::GetOrCreate(JSContext*, mozilla::dom::Element&, JS::Handle<JSObject*>, JS::MutableHandle<JS::Value>)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20f6c6d]
#09: bool mozilla::dom::GetOrCreateDOMReflector<mozilla::dom::Element>(JSContext*, mozilla::dom::Element&, JS::MutableHandle<JS::Value>, JS::Handle<JSObject*>)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20f6c1d]
#10: mozilla::EnableIf<IsBaseOf<nsWrapperCache, mozilla::dom::Element>::value, bool>::Type mozilla::dom::ToJSValue<mozilla::dom::Element>(JSContext*, mozilla::dom::Element&, JS::MutableHandle<JS::Value>)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20f6bd3]
#11: bool mozilla::dom::ToJSValue<mozilla::dom::Element>(JSContext*, RefPtr<mozilla::dom::Element> const&, JS::MutableHandle<JS::Value>)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20f6ab0]
#12: void mozilla::dom::LifecycleCreatedCallback::Call<RefPtr<mozilla::dom::Element> >(RefPtr<mozilla::dom::Element> const&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JSCompartment*)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20d993e]
#13: mozilla::dom::CustomElementCallback::Call()[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20d95d9]
#14: mozilla::dom::CustomElementData::RunCallbackQueue()[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20da5ea]
#15: mozilla::dom::CustomElementRegistry::ProcessTopElementQueue()[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20dbadd]
#16: mozilla::detail::RunnableFunction<void (*)()>::Run()[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20fc1c3]
#17: nsContentUtils::AddScriptRunner(already_AddRefed<nsIRunnable>)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x1fdae7e]
#18: nsContentUtils::AddScriptRunner(nsIRunnable*)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x1fd9c42]
#19: mozilla::dom::CustomElementRegistry::EnqueueLifecycleCallback(nsIDocument::ElementCallbackType, mozilla::dom::Element*, mozilla::dom::LifecycleCallbackArgs*, mozilla::dom::CustomElementDefinition*)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20dd46d]
#20: mozilla::dom::CustomElementRegistry::Upgrade(mozilla::dom::Element*, mozilla::dom::CustomElementDefinition*)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20dfe8e]
#21: mozilla::dom::CustomElementUpgradeReaction::Invoke(mozilla::dom::Element*)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20e0a58]
#22: mozilla::dom::CustomElementRegistry::InvokeReactions(nsTArray<nsCOMPtr<nsIWeakReference> >&)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20e0383]
#23: mozilla::dom::CustomElementRegistry::PopAndInvokeElementQueue()[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20e00e8]
#24: mozilla::dom::AutoCEReaction::~AutoCEReaction()[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20f37d1]
#25: mozilla::dom::AutoCEReaction::~AutoCEReaction()[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20df335]
#26: mozilla::dom::CustomElementRegistry::Define(nsAString_internal const&, mozilla::dom::Function&, mozilla::dom::ElementDefinitionOptions const&, mozilla::ErrorResult&)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x20debbc]
#27: mozilla::dom::CustomElementRegistryBinding::define(JSContext*, JS::Handle<JSObject*>, mozilla::dom::CustomElementRegistry*, JSJitMethodCallArgs const&)[/Volumes/workspace/mercurial/mozilla-central/obj-x86_64-apple-darwin16.4.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x2f50066]
.....

Comment 1

[Edgar Chen [:edgar]]

New upgrade steps [1] will invoke Constructor which will create JS reflector, so this crash probably won't happen with new upgrade steps ...

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1299363

Comment 2

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Jessica or John, is this issue still valid with your new patches applied?

Comment 3

[John Dai[:jdai]]

I'll investigate it, set NI to me.

Comment 4

[John Dai[:jdai]]

(In reply to Hsin-Yi Tsai [:hsinyi] from comment #2)
> Jessica or John, is this issue still valid with your new patches applied?

This bug is invalid, after landed bug 1299363.