Closed Bug 1432396 Opened 7 years ago Closed 7 years ago

Some layout/style/test/ tests fail with "ASSERTION: Stop called too early or too late" and "ASSERTION: No document in Destroy()!" on non-e10s after bug 1193394

Categories

(Core :: DOM: Navigation, defect, P2)

Product:
Core
Component:
DOM: Navigation
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla60
Tracking Flags:
Tracking Status
firefox60 --- fixed

People

(Reporter: arai, Assigned: hiro)

References

(Regressed 1 open bug)

Details

Attachments

(6 files)

Bug 1432396 - Call UnblockOnload only if we've already blocked load event.
59 bytes, text/x-review-board-request
bzbarsky
: review+
Details
Bug 1432396 - Bail out if the docshell is being destroyed due to pagehide notification.
59 bytes, text/x-review-board-request
bzbarsky
: review+
Details
Bug 1432396 - Do not process nsDocShell::Destroy() if the docshell is already being destroyed.
59 bytes, text/x-review-board-request
bzbarsky
: review+
Details
Bug 1432396 - Check the docshell is being destroyed along with the tree owner at the top of nsDocShell::CreateContentViewer().
59 bytes, text/x-review-board-request
bzbarsky
: review+
Details
Bug 1432396 - Stop the newly create orphaned viewer when the docshell is destroyed in nsDocShell::CreateContentViewer().
59 bytes, text/x-review-board-request
bzbarsky
: review+
Details
Bug 1432396 - Add assertions that we don't allow reinitialization of variables that were reset in nsDocShell::Destroy().
59 bytes, text/x-review-board-request
bzbarsky
: review+
Details
intermittently failing after bug 1193394 > TEST-UNEXPECTED-FAIL | layout/style/test/test_css_parse_error_smoketest.html | assertion count 2 is more than expected 0 assertions 04:27:10 INFO - 416 INFO None417 INFO TEST-START | layout/style/test/test_css_parse_error_smoketest.html 04:27:10 INFO - GECKO(2596) | JavaScript error: chrome://specialpowers/content/specialpowersAPI.js, line 379: TypeError: can't access dead object 04:27:10 INFO - GECKO(2596) | ++DOMWINDOW == 104 (0096FC00) [pid = 2596] [serial = 399] [outer = 1CE73940] 04:27:10 INFO - GECKO(2596) | JavaScript error: chrome://specialpowers/content/specialpowersAPI.js, line 379: TypeError: can't access dead object 04:27:10 INFO - GECKO(2596) | JavaScript error: chrome://specialpowers/content/specialpowersAPI.js, line 379: TypeError: can't access dead object 04:27:10 INFO - GECKO(2596) | JavaScript error: chrome://specialpowers/content/specialpowersAPI.js, line 379: TypeError: can't access dead object 04:27:10 INFO - GECKO(2596) | JavaScript error: chrome://specialpowers/content/specialpowersAPI.js, line 379: TypeError: can't access dead object 04:27:10 INFO - GECKO(2596) | --DOCSHELL 156C5000 == 10 [pid = 2596] [id = {d2f10408-b289-4752-8094-7ec5b23a1831}] 04:27:10 INFO - GECKO(2596) | --DOCSHELL 156CE000 == 9 [pid = 2596] [id = {1707c364-9fd5-4b13-b649-c5ff029c6de2}] 04:27:10 INFO - GECKO(2596) | --DOCSHELL 00937800 == 8 [pid = 2596] [id = {ea2eade4-6eef-4a16-a551-052a429b468f}] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 103 (0F7C0000) [pid = 2596] [serial = 287] [outer = 00000000] [url = about:blank] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 102 (13F4BC00) [pid = 2596] [serial = 120] [outer = 00000000] [url = about:blank] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 101 (0F7C3C00) [pid = 2596] [serial = 285] [outer = 00000000] [url = http://mochi.test:8888/tests/layout/style/test/test_bug771043.html] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 100 (0F7C5400) [pid = 2596] [serial = 324] [outer = 00000000] [url = about:blank] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 99 (0F0A5400) [pid = 2596] [serial = 323] [outer = 00000000] [url = about:blank] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 98 (0F862000) [pid = 2596] [serial = 325] [outer = 00000000] [url = http://mochi.test:8888/tests/layout/style/test/file_computed_style_bfcache_display_none2.html] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 97 (00969C00) [pid = 2596] [serial = 312] [outer = 00000000] [url = http://mochi.test:8888/tests/SimpleTest/iframe-between-tests.html] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 96 (00966400) [pid = 2596] [serial = 311] [outer = 00000000] [url = http://mochi.test:8888/tests/layout/style/test/test_change_hint_optimizations.html] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 95 (0E80AC00) [pid = 2596] [serial = 310] [outer = 00000000] [url = http://mochi.test:8888/tests/SimpleTest/iframe-between-tests.html] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 94 (00968400) [pid = 2596] [serial = 313] [outer = 00000000] [url = http://mochi.test:8888/tests/layout/style/test/test_clip-path_polygon.html] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 93 (0096E800) [pid = 2596] [serial = 314] [outer = 00000000] [url = http://mochi.test:8888/tests/SimpleTest/iframe-between-tests.html] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 92 (0096B000) [pid = 2596] [serial = 315] [outer = 00000000] [url = http://mochi.test:8888/tests/layout/style/test/test_color_rounding.html] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 91 (00970400) [pid = 2596] [serial = 316] [outer = 00000000] [url = http://mochi.test:8888/tests/SimpleTest/iframe-between-tests.html] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 90 (0AE09400) [pid = 2596] [serial = 321] [outer = 00000000] [url = http://mochi.test:8888/tests/layout/style/test/test_computed_style_bfcache_display_none.html] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 89 (00965C00) [pid = 2596] [serial = 317] [outer = 00000000] [url = http://mochi.test:8888/tests/layout/style/test/test_compute_data_with_start_struct.html] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 88 (0AE0D800) [pid = 2596] [serial = 318] [outer = 00000000] [url = http://mochi.test:8888/tests/SimpleTest/iframe-between-tests.html] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 87 (156CF400) [pid = 2596] [serial = 309] [outer = 00000000] [url = http://mochi.test:8888/tests/layout/style/test/test_ch_ex_no_infloops.html] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 86 (0F0A2000) [pid = 2596] [serial = 320] [outer = 00000000] [url = http://mochi.test:8888/tests/SimpleTest/iframe-between-tests.html] 04:27:10 INFO - GECKO(2596) | --DOMWINDOW == 85 (0AE15C00) [pid = 2596] [serial = 319] [outer = 00000000] [url = http://mochi.test:8888/tests/layout/style/test/test_computed_style.html] 04:27:10 INFO - GECKO(2596) | [2596, Main Thread] ###!!! ASSERTION: Stop called too early or too late: 'mDocument', file z:/build/build/src/layout/base/nsDocumentViewer.cpp, line 1831 04:27:33 INFO - GECKO(2596) | #01: nsDocumentViewer::Stop() [layout/base/nsDocumentViewer.cpp:1831] 04:27:33 INFO - GECKO(2596) | #02: nsDocShell::Stop(unsigned int) [docshell/base/nsDocShell.cpp:5157] 04:27:33 INFO - GECKO(2596) | #03: nsDocShell::Destroy() [docshell/base/nsDocShell.cpp:5465] 04:27:33 INFO - GECKO(2596) | #04: nsDocShell::~nsDocShell() [docshell/base/nsDocShell.cpp:426] 04:27:33 INFO - GECKO(2596) | #05: nsDocShell::`scalar deleting destructor'(unsigned int) 04:27:33 INFO - GECKO(2596) | #06: nsDocLoader::DeleteCycleCollectable() [uriloader/base/nsDocLoader.cpp:172] 04:27:33 INFO - GECKO(2596) | #07: nsDocLoader::cycleCollection::DeleteCycleCollectable(void *) [uriloader/base/nsDocLoader.h:74] 04:27:33 INFO - GECKO(2596) | #08: SnowWhiteKiller::~SnowWhiteKiller() [xpcom/base/nsCycleCollector.cpp:2720] 04:27:33 INFO - GECKO(2596) | #09: nsCycleCollector::FreeSnowWhite(bool) [xpcom/base/nsCycleCollector.cpp:2917] 04:27:33 INFO - GECKO(2596) | #10: nsCycleCollector_doDeferredDeletion() [xpcom/base/nsCycleCollector.cpp:4294] 04:27:33 INFO - GECKO(2596) | #11: IdleRunnableWrapper::Run() [xpcom/threads/nsThreadUtils.cpp:343] 04:27:33 INFO - GECKO(2596) | #12: nsThread::ProcessNextEvent(bool,bool *) [xpcom/threads/nsThread.cpp:1041] 04:27:33 INFO - GECKO(2596) | #13: NS_ProcessNextEvent(nsIThread *,bool) [xpcom/threads/nsThreadUtils.cpp:517] 04:27:33 INFO - GECKO(2596) | #14: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) [ipc/glue/MessagePump.cpp:97] 04:27:33 INFO - GECKO(2596) | #15: MessageLoop::RunInternal() [ipc/chromium/src/base/message_loop.cc:326] 04:27:33 INFO - GECKO(2596) | #16: MessageLoop::RunHandler() [ipc/chromium/src/base/message_loop.cc:320] 04:27:33 INFO - GECKO(2596) | #17: MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:300] 04:27:33 INFO - GECKO(2596) | #18: nsBaseAppShell::Run() [widget/nsBaseAppShell.cpp:159] 04:27:33 INFO - GECKO(2596) | #19: nsAppShell::Run() [widget/windows/nsAppShell.cpp:344] 04:27:33 INFO - GECKO(2596) | #20: nsAppStartup::Run() [toolkit/components/startup/nsAppStartup.cpp:289] 04:27:33 INFO - GECKO(2596) | #21: XREMain::XRE_mainRun() [toolkit/xre/nsAppRunner.cpp:4702] 04:27:33 INFO - GECKO(2596) | #22: XREMain::XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/nsAppRunner.cpp:4841] 04:27:33 INFO - GECKO(2596) | #23: XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/nsAppRunner.cpp:4933] 04:27:33 INFO - GECKO(2596) | #24: mozilla::BootstrapImpl::XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/Bootstrap.cpp:49] 04:27:33 INFO - GECKO(2596) | #25: do_main [browser/app/nsBrowserApp.cpp:232] 04:27:33 INFO - GECKO(2596) | #26: NS_internal_main(int,char * *,char * *) [browser/app/nsBrowserApp.cpp:304] 04:27:33 INFO - GECKO(2596) | #27: wmain [toolkit/xre/nsWindowsWMain.cpp:115] 04:27:33 INFO - GECKO(2596) | #28: __scrt_common_main_seh [f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:283] 04:27:33 INFO - GECKO(2596) | #29: kernel32.dll + 0x53c45 04:27:33 INFO - GECKO(2596) | #30: ntdll.dll + 0x637f5 04:27:33 INFO - GECKO(2596) | #31: ntdll.dll + 0x637c8 04:27:33 INFO - GECKO(2596) | [2596, Main Thread] ###!!! ASSERTION: No document in Destroy()!: 'mDocument', file z:/build/build/src/layout/base/nsDocumentViewer.cpp, line 1655 04:27:33 INFO - GECKO(2596) | #01: nsDocumentViewer::Destroy() [layout/base/nsDocumentViewer.cpp:1655] 04:27:33 INFO - GECKO(2596) | #02: nsDocShell::Destroy() [docshell/base/nsDocShell.cpp:5484] 04:27:33 INFO - GECKO(2596) | #03: nsDocShell::~nsDocShell() [docshell/base/nsDocShell.cpp:426] 04:27:33 INFO - GECKO(2596) | #04: nsDocShell::`scalar deleting destructor'(unsigned int) 04:27:33 INFO - GECKO(2596) | #05: nsDocLoader::DeleteCycleCollectable() [uriloader/base/nsDocLoader.cpp:172] 04:27:33 INFO - GECKO(2596) | #06: nsDocLoader::cycleCollection::DeleteCycleCollectable(void *) [uriloader/base/nsDocLoader.h:74] 04:27:33 INFO - GECKO(2596) | #07: SnowWhiteKiller::~SnowWhiteKiller() [xpcom/base/nsCycleCollector.cpp:2720] 04:27:33 INFO - GECKO(2596) | #08: nsCycleCollector::FreeSnowWhite(bool) [xpcom/base/nsCycleCollector.cpp:2917] 04:27:33 INFO - GECKO(2596) | #09: nsCycleCollector_doDeferredDeletion() [xpcom/base/nsCycleCollector.cpp:4294] 04:27:33 INFO - GECKO(2596) | #10: IdleRunnableWrapper::Run() [xpcom/threads/nsThreadUtils.cpp:343] 04:27:33 INFO - GECKO(2596) | #11: nsThread::ProcessNextEvent(bool,bool *) [xpcom/threads/nsThread.cpp:1041] 04:27:33 INFO - GECKO(2596) | #12: NS_ProcessNextEvent(nsIThread *,bool) [xpcom/threads/nsThreadUtils.cpp:517] 04:27:33 INFO - GECKO(2596) | #13: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) [ipc/glue/MessagePump.cpp:97] 04:27:33 INFO - GECKO(2596) | #14: MessageLoop::RunInternal() [ipc/chromium/src/base/message_loop.cc:326] 04:27:33 INFO - GECKO(2596) | #15: MessageLoop::RunHandler() [ipc/chromium/src/base/message_loop.cc:320] 04:27:33 INFO - GECKO(2596) | #16: MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:300] 04:27:33 INFO - GECKO(2596) | #17: nsBaseAppShell::Run() [widget/nsBaseAppShell.cpp:159] 04:27:33 INFO - GECKO(2596) | #18: nsAppShell::Run() [widget/windows/nsAppShell.cpp:344] 04:27:33 INFO - GECKO(2596) | #19: nsAppStartup::Run() [toolkit/components/startup/nsAppStartup.cpp:289] 04:27:33 INFO - GECKO(2596) | #20: XREMain::XRE_mainRun() [toolkit/xre/nsAppRunner.cpp:4702] 04:27:33 INFO - GECKO(2596) | #21: XREMain::XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/nsAppRunner.cpp:4841] 04:27:33 INFO - GECKO(2596) | #22: XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/nsAppRunner.cpp:4933] 04:27:33 INFO - GECKO(2596) | #23: mozilla::BootstrapImpl::XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/Bootstrap.cpp:49] 04:27:33 INFO - GECKO(2596) | #24: do_main [browser/app/nsBrowserApp.cpp:232] 04:27:33 INFO - GECKO(2596) | #25: NS_internal_main(int,char * *,char * *) [browser/app/nsBrowserApp.cpp:304] 04:27:33 INFO - GECKO(2596) | #26: wmain [toolkit/xre/nsWindowsWMain.cpp:115] 04:27:33 INFO - GECKO(2596) | #27: __scrt_common_main_seh [f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:283] 04:27:33 INFO - GECKO(2596) | #28: kernel32.dll + 0x53c45 04:27:33 INFO - GECKO(2596) | #29: ntdll.dll + 0x637f5 04:27:33 INFO - GECKO(2596) | #30: ntdll.dll + 0x637c8 04:27:33 INFO - GECKO(2596) | --DOCSHELL 0E810000 == 7 [pid = 2596] [id = {c74a9298-7b1e-4b1d-abb3-f000f42e4f55}] 04:27:33 INFO - GECKO(2596) | --DOCSHELL 10128800 == 6 [pid = 2596] [id = {fde95784-4e4e-4f57-93d9-4d3d62d6fbaf}] 04:27:33 INFO - GECKO(2596) | JavaScript error: chrome://specialpowers/content/specialpowersAPI.js, line 379: TypeError: can't access dead object 04:27:33 INFO - GECKO(2596) | MEMORY STAT | vsize 856MB | vsizeMaxContiguous 677MB | residentFast 310MB | heapAllocated 87MB 04:27:33 INFO - 418 INFO TEST-OK | layout/style/test/test_css_parse_error_smoketest.html | took 326ms 04:27:33 INFO - GECKO(2596) | JavaScript error: chrome://specialpowers/content/specialpowersAPI.js, line 379: TypeError: can't access dead object 04:27:33 INFO - GECKO(2596) | ++DOMWINDOW == 86 (00968400) [pid = 2596] [serial = 400] [outer = 1CE73940] 04:27:33 ERROR - 419 INFO TEST-UNEXPECTED-FAIL | layout/style/test/test_css_parse_error_smoketest.html | assertion count 2 is more than expected 0 assertions
here's the test, that quickly modifies style element content: https://searchfox.org/mozilla-central/source/layout/style/test/test_css_parse_error_smoketest.html and here are 2 assertions that fail, while running the test. https://searchfox.org/mozilla-central/rev/b7e3ec2468d42fa59d86c03ec7afeb209813f1d4/layout/base/nsDocumentViewer.cpp#1655 > NS_IMETHODIMP > nsDocumentViewer::Destroy() > { > NS_ASSERTION(mDocument, "No document in Destroy()!"); https://searchfox.org/mozilla-central/rev/b7e3ec2468d42fa59d86c03ec7afeb209813f1d4/layout/base/nsDocumentViewer.cpp#1831 > NS_IMETHODIMP > nsDocumentViewer::Stop(void) > { > NS_ASSERTION(mDocument, "Stop called too early or too late");
I'm not quite sure what's going on here. It doesn't seem to me this should be affected by how microtasks are scheduled, since the test doesn't seem to be using Promise at all. It only uses executeSoon which should happen in event loop anyway. There is a possibility that SimpleTest.expectConsoleMessages may end up having its "continuation" callback executed before "SimpleTest.endMonitorConsole" is called (although I have no idea why this order may be changed). In that case, we should probably just reorder the lines in SimpleTest.expectConsoleMessages.
Summary: layout/style/test/test_css_parse_error_smoketest.html fails after bug 1193394 → layout/style/test/test_css_parse_error_smoketest.html fails on non-e10s after bug 1193394
Summary: layout/style/test/test_css_parse_error_smoketest.html fails on non-e10s after bug 1193394 → layout/style/test/test_css_parse_error_smoketest.html fails on windows non-e10s after bug 1193394
here's try with some logging https://treeherder.mozilla.org/#/jobs?repo=try&revision=d48d0de6c8337ae09df3268f5417836bfb06a649 and I noticed the issue is happening on other testcases: * layout/style/test/test_css_loader_crossorigin_data_url.html * layout/style/test/test_css_cross_domain.html * layout/style/test/test_css_function_mismatched_parenthesis.html and here's the list of similar test failed only on windows 32 debug, non-e10s: * layout/style/test/test_css_cross_domain.html * layout/style/test/test_css_eof_handling.html * layout/style/test/test_css_function_mismatched_parenthesis.html * layout/style/test/test_css_loader_crossorigin_data_url.html * layout/style/test/test_css_parse_error_smoketest.html * layout/style/test/test_descriptor_storage.html * layout/style/test/test_exposed_prop_accessors.html
Summary: layout/style/test/test_css_parse_error_smoketest.html fails on windows non-e10s after bug 1193394 → Some layout/style/test/ tests fail with "ASSERTION: Stop called too early or too late" and "ASSERTION: No document in Destroy()!" on windows non-e10s after bug 1193394
So, for the problematic nsDocumentViewer, things are happening in the following order: 1. nsDocumentViewer::nsDocumentViewer ctor is called 2. nsDocumentViewer::LoadStart is called 3. set mDocument to non-null in nsDocumentViewer::LoadStart 4. nsDocumentViewer::Stop is called 5. nsDocumentViewer::Stop is called 6. nsDocumentViewer::Destroy is called 7. nsDocumentViewer::Destroy is called 8. set mDocument to null in nsDocumentViewer::Destroy 9. nsDocumentViewer::Stop is called 10. nsDocumentViewer::Destroy is called here, steps 9 and 10 are unexpected (and assertion failure happens there). I'll check how they're called.
Assignee: nobody → arai.unmht
Status: NEW → ASSIGNED
steps 9 and 10 are done 10 seconds after steps 1-8.
added stack logging https://treeherder.mozilla.org/#/jobs?repo=try&revision=9923e014ffd8cf90642adb942154b8d77323da64 here's the stacks for each step 13:18:49 1. nsDocumentViewer::nsDocumentViewer 13:18:49 2-3. nsDocumentViewer::LoadStart: set mDocument=16936800 13:18:49 4. nsDocumentViewer::Stop: mDocument=16936800 #01: nsDocShell::Stop(unsigned int) [docshell/base/nsDocShell.cpp:5167] #02: nsDocShell::InternalLoad(nsIURI *,nsIURI *,mozilla::Maybe<nsCOMPtr<nsIURI> > const &,bool,nsIURI *,unsigned int,nsIPrincipal *,nsIPrincipal *,unsigned int,nsTSubstring<char16_t> const &,char const *,nsTSubstring<char16_t> const &,nsIInputStream *,__int64,nsIInputStream *,unsigned int,nsISHEntry *,bool,nsTSubstring<char16_t> const &,nsIDocShell *,nsIURI *,nsIDocShell * *,nsIRequest * *) [docshell/base/nsDocShell.cpp:10238] #03: nsDocShell::LoadURI(nsIURI *,nsIDocShellLoadInfo *,unsigned int,bool) [docshell/base/nsDocShell.cpp:1015] #04: mozilla::dom::Location::SetURI(nsIURI *,bool) [dom/base/Location.cpp:253] #05: mozilla::dom::Location::SetHrefWithBase(nsTSubstring<char16_t> const &,nsIURI *,bool) [dom/base/Location.cpp:529] #06: mozilla::dom::Location::SetHrefWithContext(JSContext *,nsTSubstring<char16_t> const &,bool) [dom/base/Location.cpp:482] #07: mozilla::dom::Location::SetHref(nsTSubstring<char16_t> const &,mozilla::ErrorResult &) [dom/base/Location.cpp:447] #08: mozilla::dom::LocationBinding::set_href [s3:gecko-generated-sources-l1:9a796e9cfa2a1797268971d641fef39e61b7df7cfb1c829bb6df36bd7675c4a6ae2ad0b1e3de6b41c85a52a9b119b69d249a5566914ab3adc0cb7d3080f1d7a8/dom/bindings/LocationBinding.cpp::105] #09: mozilla::dom::LocationBinding::genericCrossOriginSetter [s3:gecko-generated-sources-l1:9a796e9cfa2a1797268971d641fef39e61b7df7cfb1c829bb6df36bd7675c4a6ae2ad0b1e3de6b41c85a52a9b119b69d249a5566914ab3adc0cb7d3080f1d7a8/dom/bindings/LocationBinding.cpp::1014] #10: js::CallJSNative(JSContext *,bool (*)(JSContext *,unsigned int,JS::Value *),JS::CallArgs const &) [js/src/jscntxtinlines.h:291] #11: js::InternalCallOrConstruct(JSContext *,JS::CallArgs const &,js::MaybeConstruct) [js/src/vm/Interpreter.cpp:473] #12: InternalCall [js/src/vm/Interpreter.cpp:522] #13: js::CallSetter(JSContext *,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::Handle<JS::Value>) [js/src/vm/Interpreter.cpp:670] #14: js::SetPropertyIgnoringNamedGetter(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::Handle<JS::PropertyDescriptor>,JS::ObjectOpResult &) [js/src/proxy/BaseProxyHandler.cpp:235] #15: mozilla::dom::DOMProxyHandler::set(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [dom/bindings/DOMJSProxyHandler.cpp:221] #16: js::Proxy::setInternal(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [js/src/proxy/Proxy.cpp:404] #17: js::Proxy::set(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [js/src/proxy/Proxy.cpp:414] #18: JSObject::nonNativeSetProperty(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [js/src/jsobj.cpp:1086] #19: js::SetProperty(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [js/src/vm/NativeObject.h:1637] #20: JS_SetPropertyById(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>) [js/src/jsapi.cpp:2793] #21: JS_SetProperty(JSContext *,JS::Handle<JSObject *>,char const *,JS::Handle<JS::Value>) [js/src/jsapi.cpp:2803] #22: mozilla::dom::WindowBinding::set_location [s3:gecko-generated-sources-l1:0b5c9278ec61ef797f581a53e604143a270c67bcedec2c7123a776977cf343f1663e3d72896517321abe15e616bfa73a7162163a4a32b292631fe57f98d52a1e/dom/bindings/WindowBinding.cpp::1165] #23: mozilla::dom::WindowBinding::genericCrossOriginSetter [s3:gecko-generated-sources-l1:0b5c9278ec61ef797f581a53e604143a270c67bcedec2c7123a776977cf343f1663e3d72896517321abe15e616bfa73a7162163a4a32b292631fe57f98d52a1e/dom/bindings/WindowBinding.cpp::15498] #24: js::CallJSNative(JSContext *,bool (*)(JSContext *,unsigned int,JS::Value *),JS::CallArgs const &) [js/src/jscntxtinlines.h:291] #25: js::InternalCallOrConstruct(JSContext *,JS::CallArgs const &,js::MaybeConstruct) [js/src/vm/Interpreter.cpp:473] #26: InternalCall [js/src/vm/Interpreter.cpp:522] #27: js::CallSetter(JSContext *,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::Handle<JS::Value>) [js/src/vm/Interpreter.cpp:670] #28: SetExistingProperty [js/src/vm/NativeObject.cpp:2756] #29: js::NativeSetProperty<1>(JSContext *,JS::Handle<js::NativeObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [js/src/vm/NativeObject.cpp:2784] #30: js::SetProperty(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [js/src/vm/NativeObject.h:1637] #31: js::ForwardingProxyHandler::set(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [js/src/proxy/Wrapper.cpp:163] #32: nsOuterWindowProxy::set(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [dom/base/nsGlobalWindowOuter.cpp:679] #33: js::Proxy::setInternal(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [js/src/proxy/Proxy.cpp:404] #34: js::Proxy::set(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [js/src/proxy/Proxy.cpp:414] #35: JSObject::nonNativeSetProperty(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [js/src/jsobj.cpp:1086] #36: js::SetProperty(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [js/src/vm/NativeObject.h:1637] #37: js::ForwardingProxyHandler::set(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [js/src/proxy/Wrapper.cpp:163] #38: js::CrossCompartmentWrapper::set(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [js/src/proxy/CrossCompartmentWrapper.cpp:238] #39: js::Proxy::setInternal(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [js/src/proxy/Proxy.cpp:404] #40: js::Proxy::set(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [js/src/proxy/Proxy.cpp:414] #41: JSObject::nonNativeSetProperty(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [js/src/jsobj.cpp:1086] #42: js::SetProperty(JSContext *,JS::Handle<JSObject *>,JS::Handle<jsid>,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::ObjectOpResult &) [js/src/vm/NativeObject.h:1637] #43: SetPropertyOperation [js/src/vm/Interpreter.cpp:270] #44: Interpret [js/src/vm/Interpreter.cpp:2893] #45: js::RunScript(JSContext *,js::RunState &) [js/src/vm/Interpreter.cpp:423] #46: js::InternalCallOrConstruct(JSContext *,JS::CallArgs const &,js::MaybeConstruct) [js/src/vm/Interpreter.cpp:495] #47: InternalCall [js/src/vm/Interpreter.cpp:522] #48: js::Call(JSContext *,JS::Handle<JS::Value>,JS::Handle<JS::Value>,js::AnyInvokeArgs const &,JS::MutableHandle<JS::Value>) [js/src/vm/Interpreter.cpp:541] #49: PromiseReactionJob [js/src/builtin/Promise.cpp:1238] #50: js::CallJSNative(JSContext *,bool (*)(JSContext *,unsigned int,JS::Value *),JS::CallArgs const &) [js/src/jscntxtinlines.h:291] #51: js::InternalCallOrConstruct(JSContext *,JS::CallArgs const &,js::MaybeConstruct) [js/src/vm/Interpreter.cpp:473] #52: InternalCall [js/src/vm/Interpreter.cpp:522] #53: js::Call(JSContext *,JS::Handle<JS::Value>,JS::Handle<JS::Value>,js::AnyInvokeArgs const &,JS::MutableHandle<JS::Value>) [js/src/vm/Interpreter.cpp:541] #54: JS::Call(JSContext *,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::HandleValueArray const &,JS::MutableHandle<JS::Value>) [js/src/jsapi.cpp:3038] #55: mozilla::dom::PromiseJobCallback::Call(JSContext *,JS::Handle<JS::Value>,mozilla::ErrorResult &) [s3:gecko-generated-sources-l1:e0d9926087f4de24ee4afaacc1cc138615b7c2433663bb3fa3c0eea88cc41fa84a6460e98246c72d9f7182124972696674cdda4fa5b8e2a9cff0de56372f79ef/dom/bindings/PromiseBinding.cpp::21] #56: mozilla::dom::PromiseJobCallback::Call(mozilla::ErrorResult &,char const *,mozilla::dom::CallbackObject::ExceptionHandling,JSCompartment *) [s3:gecko-generated-sources-l1:c060ccdf31aeda6569e606ecc563e5950728fda70b77aa284818f900cd27c4adbccb0675183f89dec2c09fa342e4045b5539ac95ff51ece8582cbcc4cdf899a9/dist/include/mozilla/dom/PromiseBinding.h::89] #57: mozilla::dom::PromiseJobCallback::Call(char const *) [s3:gecko-generated-sources-l1:c060ccdf31aeda6569e606ecc563e5950728fda70b77aa284818f900cd27c4adbccb0675183f89dec2c09fa342e4045b5539ac95ff51ece8582cbcc4cdf899a9/dist/include/mozilla/dom/PromiseBinding.h::104] #58: mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation &) [xpcom/base/CycleCollectedJSContext.cpp:207] #59: mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint() [xpcom/base/CycleCollectedJSContext.cpp:546] #60: mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener *,nsIDOMEvent *,mozilla::dom::EventTarget *) [dom/events/EventListenerManager.cpp:1109] #61: mozilla::EventListenerManager::HandleEventInternal(nsPresContext *,mozilla::WidgetEvent *,nsIDOMEvent * *,mozilla::dom::EventTarget *,nsEventStatus *) [dom/events/EventListenerManager.cpp:1279] #62: mozilla::EventListenerManager::HandleEvent(nsPresContext *,mozilla::WidgetEvent *,nsIDOMEvent * *,mozilla::dom::EventTarget *,nsEventStatus *) [dom/events/EventListenerManager.h:375] #63: mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor &,mozilla::ELMCreationDetector &) [dom/events/EventDispatcher.cpp:347] #64: mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem> &,mozilla::EventChainPostVisitor &,mozilla::EventDispatchingCallback *,mozilla::ELMCreationDetector &) [dom/events/EventDispatcher.cpp:498] #65: mozilla::EventDispatcher::Dispatch(nsISupports *,nsPresContext *,mozilla::WidgetEvent *,nsIDOMEvent *,nsEventStatus *,mozilla::EventDispatchingCallback *,nsTArray<mozilla::dom::EventTarget *> *) [dom/events/EventDispatcher.cpp:869] #66: mozilla::dom::PostMessageEvent::Dispatch(nsGlobalWindowInner *,mozilla::dom::Event *) [dom/base/PostMessageEvent.cpp:208] #67: mozilla::dom::PostMessageEvent::Run() [dom/base/PostMessageEvent.cpp:168] #68: nsThread::ProcessNextEvent(bool,bool *) [xpcom/threads/nsThread.cpp:1041] #69: NS_ProcessNextEvent(nsIThread *,bool) [xpcom/threads/nsThreadUtils.cpp:517] #70: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) [ipc/glue/MessagePump.cpp:97] #71: MessageLoop::RunInternal() [ipc/chromium/src/base/message_loop.cc:326] #72: MessageLoop::RunHandler() [ipc/chromium/src/base/message_loop.cc:320] #73: MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:300] #74: nsBaseAppShell::Run() [widget/nsBaseAppShell.cpp:159] #75: nsAppShell::Run() [widget/windows/nsAppShell.cpp:344] #76: nsAppStartup::Run() [toolkit/components/startup/nsAppStartup.cpp:289] #77: XREMain::XRE_mainRun() [toolkit/xre/nsAppRunner.cpp:4707] #78: XREMain::XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/nsAppRunner.cpp:4842] #79: XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/nsAppRunner.cpp:4934] #80: mozilla::BootstrapImpl::XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/Bootstrap.cpp:49] #81: do_main [browser/app/nsBrowserApp.cpp:232] #82: NS_internal_main(int,char * *,char * *) [browser/app/nsBrowserApp.cpp:304] #83: wmain [toolkit/xre/nsWindowsWMain.cpp:115] #84: __scrt_common_main_seh [f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:283] #85: kernel32.dll + 0x53c45 #86: ntdll.dll + 0x637f5 #87: ntdll.dll + 0x637c8 13:18:49 5. nsDocumentViewer::Stop: mDocument=16936800 #01: nsDocShell::SetupNewViewer(nsIContentViewer *) [docshell/base/nsDocShell.cpp:9023] #02: nsDocShell::Embed(nsIContentViewer *,char const *,nsISupports *) [docshell/base/nsDocShell.cpp:6876] #03: nsDocShell::CreateContentViewer(nsTSubstring<char> const &,nsIRequest *,nsIStreamListener * *) [docshell/base/nsDocShell.cpp:8856] #04: nsDSURIContentListener::DoContent(nsTSubstring<char> const &,bool,nsIRequest *,nsIStreamListener * *,bool *) [docshell/base/nsDSURIContentListener.cpp:196] #05: nsDocumentOpenInfo::TryContentListener(nsIURIContentListener *,nsIChannel *) [uriloader/base/nsURILoader.cpp:739] #06: nsDocumentOpenInfo::DispatchContent(nsIRequest *,nsISupports *) [uriloader/base/nsURILoader.cpp:417] #07: nsDocumentOpenInfo::OnStartRequest(nsIRequest *,nsISupports *) [uriloader/base/nsURILoader.cpp:297] #08: mozilla::net::nsHttpChannel::CallOnStartRequest() [netwerk/protocol/http/nsHttpChannel.cpp:1555] #09: mozilla::net::nsHttpChannel::ContinueProcessNormal(nsresult) [netwerk/protocol/http/nsHttpChannel.cpp:2700] #10: mozilla::net::nsHttpChannel::ProcessNormal() [netwerk/protocol/http/nsHttpChannel.cpp:2633] #11: mozilla::net::nsHttpChannel::ContinueProcessResponse2(nsresult) [netwerk/protocol/http/nsHttpChannel.cpp:2512] #12: mozilla::net::nsHttpChannel::ContinueProcessResponse1() [netwerk/protocol/http/nsHttpChannel.cpp:2341] #13: mozilla::net::nsHttpChannel::ProcessResponse() [netwerk/protocol/http/nsHttpChannel.cpp:2241] #14: mozilla::net::nsHttpChannel::OnStartRequest(nsIRequest *,nsISupports *) [netwerk/protocol/http/nsHttpChannel.cpp:6905] #15: nsInputStreamPump::OnStateStart() [netwerk/base/nsInputStreamPump.cpp:519] #16: nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream *) [netwerk/base/nsInputStreamPump.cpp:436] #17: nsInputStreamReadyEvent::Run() [xpcom/io/nsStreamUtils.cpp:99] #18: nsThread::ProcessNextEvent(bool,bool *) [xpcom/threads/nsThread.cpp:1041] #19: NS_ProcessNextEvent(nsIThread *,bool) [xpcom/threads/nsThreadUtils.cpp:517] #20: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) [ipc/glue/MessagePump.cpp:97] #21: MessageLoop::RunInternal() [ipc/chromium/src/base/message_loop.cc:326] #22: MessageLoop::RunHandler() [ipc/chromium/src/base/message_loop.cc:320] #23: MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:300] #24: nsBaseAppShell::Run() [widget/nsBaseAppShell.cpp:159] #25: nsAppShell::Run() [widget/windows/nsAppShell.cpp:344] #26: nsAppStartup::Run() [toolkit/components/startup/nsAppStartup.cpp:289] #27: XREMain::XRE_mainRun() [toolkit/xre/nsAppRunner.cpp:4707] #28: XREMain::XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/nsAppRunner.cpp:4842] #29: XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/nsAppRunner.cpp:4934] #30: mozilla::BootstrapImpl::XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/Bootstrap.cpp:49] #31: do_main [browser/app/nsBrowserApp.cpp:232] #32: NS_internal_main(int,char * *,char * *) [browser/app/nsBrowserApp.cpp:304] #33: wmain [toolkit/xre/nsWindowsWMain.cpp:115] #34: __scrt_common_main_seh [f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:283] #35: kernel32.dll + 0x53c45 #36: ntdll.dll + 0x637f5 #37: ntdll.dll + 0x637c8 13:18:49 6. nsDocumentViewer::Destroy: mDocument=16936800 #01: nsDocumentViewer::Show() [layout/base/nsDocumentViewer.cpp:2149] #02: nsPresContext::EnsureVisible() [layout/base/nsPresContext.cpp:2244] #03: mozilla::PresShell::UnsuppressAndInvalidate() [layout/base/PresShell.cpp:3918] #04: nsDocShell::EndPageLoad(nsIWebProgress *,nsIChannel *,nsresult) [docshell/base/nsDocShell.cpp:7259] #05: nsDocShell::OnStateChange(nsIWebProgress *,nsIRequest *,unsigned int,nsresult) [docshell/base/nsDocShell.cpp:7052] #06: nsDocLoader::DoFireOnStateChange(nsIWebProgress * const,nsIRequest * const,int &,nsresult) [uriloader/base/nsDocLoader.cpp:1319] #07: nsDocLoader::doStopDocumentLoad(nsIRequest *,nsresult) [uriloader/base/nsDocLoader.cpp:862] #08: nsDocLoader::DocLoaderIsEmpty(bool) [uriloader/base/nsDocLoader.cpp:753] #09: nsDocLoader::OnStopRequest(nsIRequest *,nsISupports *,nsresult) [uriloader/base/nsDocLoader.cpp:634] #10: mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest *,nsISupports *,nsresult) [netwerk/base/nsLoadGroup.cpp:629] #11: nsDocument::DoUnblockOnload() [dom/base/nsDocument.cpp:8939] #12: nsDocument::UnblockOnload(bool) [dom/base/nsDocument.cpp:8860] #13: nsDocument::DispatchContentLoadedEvents() [dom/base/nsDocument.cpp:5527] #14: mozilla::detail::RunnableMethodImpl<nsDocument *,void ( nsDocument::*)(void),1,0>::Run() [xpcom/threads/nsThreadUtils.h:1196] #15: nsThread::ProcessNextEvent(bool,bool *) [xpcom/threads/nsThread.cpp:1041] #16: NS_ProcessNextEvent(nsIThread *,bool) [xpcom/threads/nsThreadUtils.cpp:517] #17: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) [ipc/glue/MessagePump.cpp:97] #18: MessageLoop::RunInternal() [ipc/chromium/src/base/message_loop.cc:326] #19: MessageLoop::RunHandler() [ipc/chromium/src/base/message_loop.cc:320] #20: MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:300] #21: nsBaseAppShell::Run() [widget/nsBaseAppShell.cpp:159] #22: nsAppShell::Run() [widget/windows/nsAppShell.cpp:344] #23: nsAppStartup::Run() [toolkit/components/startup/nsAppStartup.cpp:289] #24: XREMain::XRE_mainRun() [toolkit/xre/nsAppRunner.cpp:4707] #25: XREMain::XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/nsAppRunner.cpp:4842] #26: XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/nsAppRunner.cpp:4934] #27: mozilla::BootstrapImpl::XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/Bootstrap.cpp:49] #28: do_main [browser/app/nsBrowserApp.cpp:232] #29: NS_internal_main(int,char * *,char * *) [browser/app/nsBrowserApp.cpp:304] #30: wmain [toolkit/xre/nsWindowsWMain.cpp:115] #31: __scrt_common_main_seh [f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:283] #32: kernel32.dll + 0x53c45 #33: ntdll.dll + 0x637f5 #34: ntdll.dll + 0x637c8 13:18:49 7. nsDocumentViewer::Destroy: mDocument=16936800 #01: nsSHistory::EvictContentViewerForTransaction(nsISHTransaction *) [docshell/shistory/nsSHistory.cpp:226] #02: nsSHistory::EvictAllContentViewers() [docshell/shistory/nsSHistory.cpp:1057] #03: nsDocShell::Destroy() [docshell/base/nsDocShell.cpp:5516] #04: nsFrameLoader::DestroyDocShell() [dom/base/nsFrameLoader.cpp:1893] #05: nsFrameLoaderDestroyRunnable::Run() [dom/base/nsFrameLoader.cpp:1836] #06: nsDocument::MaybeInitializeFinalizeFrameLoaders() [dom/base/nsDocument.cpp:7153] #07: nsDocument::EndUpdate(unsigned int) [dom/base/nsDocument.cpp:5287] #08: mozilla::dom::XULDocument::EndUpdate(unsigned int) [dom/xul/XULDocument.cpp:3000] #09: mozAutoDocUpdate::~mozAutoDocUpdate() [dom/base/mozAutoDocUpdate.h:42] #10: mozilla::dom::FragmentOrElement::RemoveChildAt_Deprecated(unsigned int,bool) [dom/base/FragmentOrElement.cpp:1178] #11: nsXULElement::RemoveChildAt_Deprecated(unsigned int,bool) [dom/xul/nsXULElement.cpp:900] #12: nsINode::RemoveChild(nsINode &,mozilla::ErrorResult &) [dom/base/nsINode.cpp:618] #13: nsINode::Remove() [dom/base/nsINode.cpp:1864] #14: mozilla::dom::ElementBinding::remove [s3:gecko-generated-sources-l1:856f207f00d27a0630c54ab5803da3f427312c651500f638674aabe6aaf2029268cd7912e94a28f99a82a2ffc0ef774f1e010f2f6bbfa4fa0f4c9588e864c36d/dom/bindings/ElementBinding.cpp::4333] #15: mozilla::dom::GenericBindingMethod(JSContext *,unsigned int,JS::Value *) [dom/bindings/BindingUtils.cpp:3036] #16: js::CallJSNative(JSContext *,bool (*)(JSContext *,unsigned int,JS::Value *),JS::CallArgs const &) [js/src/jscntxtinlines.h:291] #17: js::InternalCallOrConstruct(JSContext *,JS::CallArgs const &,js::MaybeConstruct) [js/src/vm/Interpreter.cpp:473] #18: InternalCall [js/src/vm/Interpreter.cpp:522] #19: Interpret [js/src/vm/Interpreter.cpp:3096] #20: js::RunScript(JSContext *,js::RunState &) [js/src/vm/Interpreter.cpp:423] #21: js::InternalCallOrConstruct(JSContext *,JS::CallArgs const &,js::MaybeConstruct) [js/src/vm/Interpreter.cpp:495] #22: InternalCall [js/src/vm/Interpreter.cpp:522] #23: js::Call(JSContext *,JS::Handle<JS::Value>,JS::Handle<JS::Value>,js::AnyInvokeArgs const &,JS::MutableHandle<JS::Value>) [js/src/vm/Interpreter.cpp:541] #24: JS::Call(JSContext *,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::HandleValueArray const &,JS::MutableHandle<JS::Value>) [js/src/jsapi.cpp:3038] #25: mozilla::dom::EventHandlerNonNull::Call(JSContext *,JS::Handle<JS::Value>,mozilla::dom::Event &,JS::MutableHandle<JS::Value>,mozilla::ErrorResult &) [s3:gecko-generated-sources-l1:8f2503e2a83a57ff67424bb2177bac17c2b07748c3acb3d2fac390df70e68c519ac141cf000a4148cae8b3ef7faa4c6cde18b6b81d422adb7d2f27a13de7a49c/dom/bindings/EventHandlerBinding.cpp::260] #26: mozilla::dom::EventHandlerNonNull::Call<nsISupports *>(nsISupports * const &,mozilla::dom::Event &,JS::MutableHandle<JS::Value>,mozilla::ErrorResult &,char const *,mozilla::dom::CallbackObject::ExceptionHandling,JSCompartment *) [s3:gecko-generated-sources-l1:c4fc45fd92579da9bf575e45c43cfa1acedef7bc1a869011df870211d66123c95c9bf5b8404577e68c1f52ad0aad4be07158002e35b350409da31660e5fba70e/dist/include/mozilla/dom/EventHandlerBinding.h::362] #27: mozilla::JSEventHandler::HandleEvent(nsIDOMEvent *) [dom/events/JSEventHandler.cpp:216] #28: nsXBLPrototypeHandler::ExecuteHandler(mozilla::dom::EventTarget *,nsIDOMEvent *) [dom/xbl/nsXBLPrototypeHandler.cpp:393] #29: nsXBLEventHandler::HandleEvent(nsIDOMEvent *) [dom/xbl/nsXBLEventHandler.cpp:52] #30: mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener *,nsIDOMEvent *,mozilla::dom::EventTarget *) [dom/events/EventListenerManager.cpp:1107] #31: mozilla::EventListenerManager::HandleEventInternal(nsPresContext *,mozilla::WidgetEvent *,nsIDOMEvent * *,mozilla::dom::EventTarget *,nsEventStatus *) [dom/events/EventListenerManager.cpp:1279] #32: mozilla::EventListenerManager::HandleEvent(nsPresContext *,mozilla::WidgetEvent *,nsIDOMEvent * *,mozilla::dom::EventTarget *,nsEventStatus *) [dom/events/EventListenerManager.h:375] #33: mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor &,mozilla::ELMCreationDetector &) [dom/events/EventDispatcher.cpp:347] #34: mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem> &,mozilla::EventChainPostVisitor &,mozilla::EventDispatchingCallback *,mozilla::ELMCreationDetector &) [dom/events/EventDispatcher.cpp:477] #35: mozilla::EventDispatcher::Dispatch(nsISupports *,nsPresContext *,mozilla::WidgetEvent *,nsIDOMEvent *,nsEventStatus *,mozilla::EventDispatchingCallback *,nsTArray<mozilla::dom::EventTarget *> *) [dom/events/EventDispatcher.cpp:869] #36: mozilla::EventDispatcher::DispatchDOMEvent(nsISupports *,mozilla::WidgetEvent *,nsIDOMEvent *,nsPresContext *,nsEventStatus *) [dom/events/EventDispatcher.cpp:932] #37: nsGlobalWindowInner::DispatchEvent(nsIDOMEvent *,bool *) [dom/base/nsGlobalWindowInner.cpp:4397] #38: nsGlobalWindowOuter::DispatchEvent(nsIDOMEvent *,bool *) [dom/base/nsGlobalWindowOuter.cpp:6502] #39: nsContentUtils::DispatchEvent(nsIDocument *,nsISupports *,nsTSubstring<char16_t> const &,bool,bool,bool,bool *,bool) [dom/base/nsContentUtils.cpp:4506] #40: nsContentUtils::DispatchTrustedEvent(nsIDocument *,nsISupports *,nsTSubstring<char16_t> const &,bool,bool,bool *) [dom/base/nsContentUtils.cpp:4474] #41: nsGlobalWindowOuter::DispatchCustomEvent(nsTSubstring<char16_t> const &) [dom/base/nsGlobalWindowOuter.cpp:3862] #42: nsGlobalWindowOuter::CloseOuter(bool) [dom/base/nsGlobalWindowOuter.cpp:6005] #43: nsGlobalWindowInner::Close(mozilla::ErrorResult &) [dom/base/nsGlobalWindowInner.cpp:4054] #44: mozilla::dom::WindowBinding::close [s3:gecko-generated-sources-l1:0b5c9278ec61ef797f581a53e604143a270c67bcedec2c7123a776977cf343f1663e3d72896517321abe15e616bfa73a7162163a4a32b292631fe57f98d52a1e/dom/bindings/WindowBinding.cpp::1682] #45: mozilla::dom::WindowBinding::genericCrossOriginMethod [s3:gecko-generated-sources-l1:0b5c9278ec61ef797f581a53e604143a270c67bcedec2c7123a776977cf343f1663e3d72896517321abe15e616bfa73a7162163a4a32b292631fe57f98d52a1e/dom/bindings/WindowBinding.cpp::15275] #46: js::CallJSNative(JSContext *,bool (*)(JSContext *,unsigned int,JS::Value *),JS::CallArgs const &) [js/src/jscntxtinlines.h:291] #47: js::InternalCallOrConstruct(JSContext *,JS::CallArgs const &,js::MaybeConstruct) [js/src/vm/Interpreter.cpp:473] #48: InternalCall [js/src/vm/Interpreter.cpp:522] #49: js::Call(JSContext *,JS::Handle<JS::Value>,JS::Handle<JS::Value>,js::AnyInvokeArgs const &,JS::MutableHandle<JS::Value>) [js/src/vm/Interpreter.cpp:541] #50: js::ForwardingProxyHandler::call(JSContext *,JS::Handle<JSObject *>,JS::CallArgs const &) [js/src/proxy/Wrapper.cpp:176] #51: js::CrossCompartmentWrapper::call(JSContext *,JS::Handle<JSObject *>,JS::CallArgs const &) [js/src/proxy/CrossCompartmentWrapper.cpp:359] #52: js::proxy_Call(JSContext *,unsigned int,JS::Value *) [js/src/proxy/Proxy.cpp:770] #53: js::CallJSNative(JSContext *,bool (*)(JSContext *,unsigned int,JS::Value *),JS::CallArgs const &) [js/src/jscntxtinlines.h:291] #54: js::InternalCallOrConstruct(JSContext *,JS::CallArgs const &,js::MaybeConstruct) [js/src/vm/Interpreter.cpp:455] #55: InternalCall [js/src/vm/Interpreter.cpp:522] #56: Interpret [js/src/vm/Interpreter.cpp:3096] #57: js::RunScript(JSContext *,js::RunState &) [js/src/vm/Interpreter.cpp:423] #58: js::InternalCallOrConstruct(JSContext *,JS::CallArgs const &,js::MaybeConstruct) [js/src/vm/Interpreter.cpp:495] #59: InternalCall [js/src/vm/Interpreter.cpp:522] #60: js::Call(JSContext *,JS::Handle<JS::Value>,JS::Handle<JS::Value>,js::AnyInvokeArgs const &,JS::MutableHandle<JS::Value>) [js/src/vm/Interpreter.cpp:541] #61: PromiseReactionJob [js/src/builtin/Promise.cpp:1238] #62: js::CallJSNative(JSContext *,bool (*)(JSContext *,unsigned int,JS::Value *),JS::CallArgs const &) [js/src/jscntxtinlines.h:291] #63: js::InternalCallOrConstruct(JSContext *,JS::CallArgs const &,js::MaybeConstruct) [js/src/vm/Interpreter.cpp:473] #64: InternalCall [js/src/vm/Interpreter.cpp:522] #65: js::Call(JSContext *,JS::Handle<JS::Value>,JS::Handle<JS::Value>,js::AnyInvokeArgs const &,JS::MutableHandle<JS::Value>) [js/src/vm/Interpreter.cpp:541] #66: JS::Call(JSContext *,JS::Handle<JS::Value>,JS::Handle<JS::Value>,JS::HandleValueArray const &,JS::MutableHandle<JS::Value>) [js/src/jsapi.cpp:3038] #67: mozilla::dom::PromiseJobCallback::Call(JSContext *,JS::Handle<JS::Value>,mozilla::ErrorResult &) [s3:gecko-generated-sources-l1:e0d9926087f4de24ee4afaacc1cc138615b7c2433663bb3fa3c0eea88cc41fa84a6460e98246c72d9f7182124972696674cdda4fa5b8e2a9cff0de56372f79ef/dom/bindings/PromiseBinding.cpp::21] #68: mozilla::dom::PromiseJobCallback::Call(mozilla::ErrorResult &,char const *,mozilla::dom::CallbackObject::ExceptionHandling,JSCompartment *) [s3:gecko-generated-sources-l1:c060ccdf31aeda6569e606ecc563e5950728fda70b77aa284818f900cd27c4adbccb0675183f89dec2c09fa342e4045b5539ac95ff51ece8582cbcc4cdf899a9/dist/include/mozilla/dom/PromiseBinding.h::89] #69: mozilla::dom::PromiseJobCallback::Call(char const *) [s3:gecko-generated-sources-l1:c060ccdf31aeda6569e606ecc563e5950728fda70b77aa284818f900cd27c4adbccb0675183f89dec2c09fa342e4045b5539ac95ff51ece8582cbcc4cdf899a9/dist/include/mozilla/dom/PromiseBinding.h::104] #70: mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation &) [xpcom/base/CycleCollectedJSContext.cpp:207] #71: mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint() [xpcom/base/CycleCollectedJSContext.cpp:546] #72: mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener *,nsIDOMEvent *,mozilla::dom::EventTarget *) [dom/events/EventListenerManager.cpp:1109] #73: mozilla::EventListenerManager::HandleEventInternal(nsPresContext *,mozilla::WidgetEvent *,nsIDOMEvent * *,mozilla::dom::EventTarget *,nsEventStatus *) [dom/events/EventListenerManager.cpp:1279] #74: mozilla::EventListenerManager::HandleEvent(nsPresContext *,mozilla::WidgetEvent *,nsIDOMEvent * *,mozilla::dom::EventTarget *,nsEventStatus *) [dom/events/EventListenerManager.h:375] #75: mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor &,mozilla::ELMCreationDetector &) [dom/events/EventDispatcher.cpp:347] #76: mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem> &,mozilla::EventChainPostVisitor &,mozilla::EventDispatchingCallback *,mozilla::ELMCreationDetector &) [dom/events/EventDispatcher.cpp:498] #77: mozilla::EventDispatcher::Dispatch(nsISupports *,nsPresContext *,mozilla::WidgetEvent *,nsIDOMEvent *,nsEventStatus *,mozilla::EventDispatchingCallback *,nsTArray<mozilla::dom::EventTarget *> *) [dom/events/EventDispatcher.cpp:869] #78: mozilla::EventDispatcher::DispatchDOMEvent(nsISupports *,mozilla::WidgetEvent *,nsIDOMEvent *,nsPresContext *,nsEventStatus *) [dom/events/EventDispatcher.cpp:932] #79: nsDocument::DispatchPageTransition(mozilla::dom::EventTarget *,nsTSubstring<char16_t> const &,bool) [dom/base/nsDocument.cpp:8982] #80: nsDocument::OnPageHide(bool,mozilla::dom::EventTarget *) [dom/base/nsDocument.cpp:9145] #81: nsDocumentViewer::PageHide(bool) [layout/base/nsDocumentViewer.cpp:1419] #82: nsDocShell::FirePageHideNotificationInternal(bool,bool) [docshell/base/nsDocShell.cpp:1151] #83: nsDocShell::FirePageHideNotification(bool) [docshell/base/nsDocShell.cpp:1132] #84: nsDocShell::RestoreFromHistory() [docshell/base/nsDocShell.cpp:8246] #85: nsDocShell::RestorePresentationEvent::Run() [docshell/base/nsDocShell.cpp:7963] #86: nsThread::ProcessNextEvent(bool,bool *) [xpcom/threads/nsThread.cpp:1041] #87: NS_ProcessNextEvent(nsIThread *,bool) [xpcom/threads/nsThreadUtils.cpp:517] #88: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) [ipc/glue/MessagePump.cpp:97] #89: MessageLoop::RunInternal() [ipc/chromium/src/base/message_loop.cc:326] #90: MessageLoop::RunHandler() [ipc/chromium/src/base/message_loop.cc:320] #91: MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:300] #92: nsBaseAppShell::Run() [widget/nsBaseAppShell.cpp:159] #93: nsAppShell::Run() [widget/windows/nsAppShell.cpp:344] #94: nsAppStartup::Run() [toolkit/components/startup/nsAppStartup.cpp:289] #95: XREMain::XRE_mainRun() [toolkit/xre/nsAppRunner.cpp:4707] #96: XREMain::XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/nsAppRunner.cpp:4842] #97: XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/nsAppRunner.cpp:4934] #98: mozilla::BootstrapImpl::XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/Bootstrap.cpp:49] #99: do_main [browser/app/nsBrowserApp.cpp:232] #100: NS_internal_main(int,char * *,char * *) [browser/app/nsBrowserApp.cpp:304] #101: wmain [toolkit/xre/nsWindowsWMain.cpp:115] #102: __scrt_common_main_seh [f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:283] #103: kernel32.dll + 0x53c45 #104: ntdll.dll + 0x637f5 #105: ntdll.dll + 0x637c8 13:18:49 8. nsDocumentViewer::Destroy: set mDocument=00000000 13:18:58 9. nsDocumentViewer::Stop: mDocument=00000000 #01: nsDocShell::Stop(unsigned int) [docshell/base/nsDocShell.cpp:5167] #02: nsDocShell::Destroy() [docshell/base/nsDocShell.cpp:5475] #03: nsDocShell::~nsDocShell() [docshell/base/nsDocShell.cpp:428] #04: nsDocShell::`scalar deleting destructor'(unsigned int) #05: nsDocLoader::DeleteCycleCollectable() [uriloader/base/nsDocLoader.cpp:172] #06: nsDocLoader::cycleCollection::DeleteCycleCollectable(void *) [uriloader/base/nsDocLoader.h:74] #07: SnowWhiteKiller::~SnowWhiteKiller() [xpcom/base/nsCycleCollector.cpp:2720] #08: nsCycleCollector::FreeSnowWhite(bool) [xpcom/base/nsCycleCollector.cpp:2917] #09: nsCycleCollector_doDeferredDeletion() [xpcom/base/nsCycleCollector.cpp:4294] #10: IdleRunnableWrapper::Run() [xpcom/threads/nsThreadUtils.cpp:343] #11: nsThread::ProcessNextEvent(bool,bool *) [xpcom/threads/nsThread.cpp:1041] #12: NS_ProcessNextEvent(nsIThread *,bool) [xpcom/threads/nsThreadUtils.cpp:517] #13: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) [ipc/glue/MessagePump.cpp:97] #14: MessageLoop::RunInternal() [ipc/chromium/src/base/message_loop.cc:326] #15: MessageLoop::RunHandler() [ipc/chromium/src/base/message_loop.cc:320] #16: MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:300] #17: nsBaseAppShell::Run() [widget/nsBaseAppShell.cpp:159] #18: nsAppShell::Run() [widget/windows/nsAppShell.cpp:344] #19: nsAppStartup::Run() [toolkit/components/startup/nsAppStartup.cpp:289] #20: XREMain::XRE_mainRun() [toolkit/xre/nsAppRunner.cpp:4707] #21: XREMain::XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/nsAppRunner.cpp:4842] #22: XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/nsAppRunner.cpp:4934] #23: mozilla::BootstrapImpl::XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/Bootstrap.cpp:49] #24: do_main [browser/app/nsBrowserApp.cpp:232] #25: NS_internal_main(int,char * *,char * *) [browser/app/nsBrowserApp.cpp:304] #26: wmain [toolkit/xre/nsWindowsWMain.cpp:115] #27: __scrt_common_main_seh [f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:283] #28: kernel32.dll + 0x53c45 #29: ntdll.dll + 0x637f5 #30: ntdll.dll + 0x637c8 13:18:58 10. nsDocumentViewer::Destroy: mDocument=00000000 #01: nsDocShell::Destroy() [docshell/base/nsDocShell.cpp:5494] #02: nsDocShell::~nsDocShell() [docshell/base/nsDocShell.cpp:428] #03: nsDocShell::`scalar deleting destructor'(unsigned int) #04: nsDocLoader::DeleteCycleCollectable() [uriloader/base/nsDocLoader.cpp:172] #05: nsDocLoader::cycleCollection::DeleteCycleCollectable(void *) [uriloader/base/nsDocLoader.h:74] #06: SnowWhiteKiller::~SnowWhiteKiller() [xpcom/base/nsCycleCollector.cpp:2720] #07: nsCycleCollector::FreeSnowWhite(bool) [xpcom/base/nsCycleCollector.cpp:2917] #08: nsCycleCollector_doDeferredDeletion() [xpcom/base/nsCycleCollector.cpp:4294] #09: IdleRunnableWrapper::Run() [xpcom/threads/nsThreadUtils.cpp:343] #10: nsThread::ProcessNextEvent(bool,bool *) [xpcom/threads/nsThread.cpp:1041] #11: NS_ProcessNextEvent(nsIThread *,bool) [xpcom/threads/nsThreadUtils.cpp:517] #12: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate *) [ipc/glue/MessagePump.cpp:97] #13: MessageLoop::RunInternal() [ipc/chromium/src/base/message_loop.cc:326] #14: MessageLoop::RunHandler() [ipc/chromium/src/base/message_loop.cc:320] #15: MessageLoop::Run() [ipc/chromium/src/base/message_loop.cc:300] #16: nsBaseAppShell::Run() [widget/nsBaseAppShell.cpp:159] #17: nsAppShell::Run() [widget/windows/nsAppShell.cpp:344] #18: nsAppStartup::Run() [toolkit/components/startup/nsAppStartup.cpp:289] #19: XREMain::XRE_mainRun() [toolkit/xre/nsAppRunner.cpp:4707] #20: XREMain::XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/nsAppRunner.cpp:4842] #21: XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/nsAppRunner.cpp:4934] #22: mozilla::BootstrapImpl::XRE_main(int,char * * const,mozilla::BootstrapConfig const &) [toolkit/xre/Bootstrap.cpp:49] #23: do_main [browser/app/nsBrowserApp.cpp:232] #24: NS_internal_main(int,char * *,char * *) [browser/app/nsBrowserApp.cpp:304] #25: wmain [toolkit/xre/nsWindowsWMain.cpp:115] #26: __scrt_common_main_seh [f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:283] #27: kernel32.dll + 0x53c45 #28: ntdll.dll + 0x637f5 #29: ntdll.dll + 0x637c8
nsDocumentViewer::Destroy is called thrice: 1. from nsDocumentViewer::Show, destroying previous viewer puts itself to SHEntry (in this case mDocument is not destroyed) 2. from nsSHistory::EvictContentViewerForTransaction destroys mDocument because mSHEntry is nullptr 3. from nsDocShell::~nsDocShell assertion fails herebecause mDocument is already destroyed https://searchfox.org/mozilla-central/rev/11d0ff9f36465ce19b0c43d1ecc3025791eeb808/layout/base/nsDocumentViewer.cpp#1785 > NS_IMETHODIMP > nsDocumentViewer::Destroy() > { > NS_ASSERTION(mDocument, "No document in Destroy()!"); > ... > // If we were told to put ourselves into session history instead of destroy > // the presentation, do that now. > if (mSHEntry) { > ... > mSHEntry = nullptr; > ... > if (savePresentation) { > shEntry->SetContentViewer(this); > } > ... > return NS_OK; > } > ... > if (mDocument) { > mDocument->Destroy(); > mDocument = nullptr; > } https://searchfox.org/mozilla-central/rev/11d0ff9f36465ce19b0c43d1ecc3025791eeb808/layout/base/nsDocumentViewer.cpp#2118 > NS_IMETHODIMP > nsDocumentViewer::Show(void) > { > NS_ENSURE_TRUE(mDocument, NS_ERROR_NOT_AVAILABLE); > > // We don't need the previous viewer anymore since we're not > // displaying it. > if (mPreviousViewer) { > // This little dance *may* only be to keep > // PresShell::EndObservingDocument happy, but I'm not sure. > nsCOMPtr<nsIContentViewer> prevViewer(mPreviousViewer); > mPreviousViewer = nullptr; > prevViewer->Destroy(); https://searchfox.org/mozilla-central/rev/11d0ff9f36465ce19b0c43d1ecc3025791eeb808/docshell/shistory/nsSHistory.cpp#222 > void > nsSHistory::EvictContentViewerForTransaction(nsISHTransaction* aTrans) > { > nsCOMPtr<nsISHEntry> entry; > aTrans->GetSHEntry(getter_AddRefs(entry)); > nsCOMPtr<nsIContentViewer> viewer; > nsCOMPtr<nsISHEntry> ownerEntry; > entry->GetAnyContentViewer(getter_AddRefs(ownerEntry), > getter_AddRefs(viewer)); > if (viewer) { > NS_ASSERTION(ownerEntry, "Content viewer exists but its SHEntry is null"); > > LOG_SHENTRY_SPEC(("Evicting content viewer 0x%p for " > "owning SHEntry 0x%p at %s.", > viewer.get(), ownerEntry.get(), _spec), > ownerEntry); > > // Drop the presentation state before destroying the viewer, so that > // document teardown is able to correctly persist the state. > ownerEntry->SetContentViewer(nullptr); > ownerEntry->SyncPresentationState(); > viewer->Destroy(); https://searchfox.org/mozilla-central/rev/11d0ff9f36465ce19b0c43d1ecc3025791eeb808/docshell/base/nsDocShell.cpp#425 > nsDocShell::~nsDocShell() > { > ... > Destroy(); https://searchfox.org/mozilla-central/rev/11d0ff9f36465ce19b0c43d1ecc3025791eeb808/docshell/base/nsDocShell.cpp#5492 > NS_IMETHODIMP > nsDocShell::Destroy() > { > ... > if (mContentViewer) { > mContentViewer->Close(nullptr); > mContentViewer->Destroy(); > mContentViewer = nullptr; > } So, it seems that the issue is, why nsDocShell has the reference to mContentViewer after the nsDocumentViewer gets destroyed by nsSHistory::EvictContentViewerForTransaction.
Here's the list of places that sets nsDocumentViewer.mPreviousViewer to non-null value: https://searchfox.org/mozilla-central/rev/11d0ff9f36465ce19b0c43d1ecc3025791eeb808/layout/base/nsDocumentViewer.cpp#2038 > NS_IMETHODIMP > nsDocumentViewer::SetPreviousViewer(nsIContentViewer* aViewer) > { > ... > if (aViewer) { > ... > nsCOMPtr<nsIContentViewer> prevViewer; > aViewer->GetPreviousViewer(getter_AddRefs(prevViewer)); > if (prevViewer) { > aViewer->SetPreviousViewer(nullptr); > aViewer->Destroy(); > return SetPreviousViewer(prevViewer); > } > } > > mPreviousViewer = aViewer; > return NS_OK; > } https://searchfox.org/mozilla-central/rev/11d0ff9f36465ce19b0c43d1ecc3025791eeb808/docshell/base/nsDocShell.cpp#8358 > nsresult > nsDocShell::RestoreFromHistory() > { > ... > if (mContentViewer) { > mContentViewer->Close(mSavingOldViewer ? mOSHE.get() : nullptr); > viewer->SetPreviousViewer(mContentViewer); > } >... > mContentViewer = nullptr; https://searchfox.org/mozilla-central/rev/11d0ff9f36465ce19b0c43d1ecc3025791eeb808/docshell/base/nsDocShell.cpp#9030 > nsresult > nsDocShell::SetupNewViewer(nsIContentViewer* aNewViewer) > { > ... > nsCOMPtr<nsIContentViewer> contentViewer = mContentViewer; > if (contentViewer) { > contentViewer->Close(mSavingOldViewer ? mOSHE.get() : nullptr); > aNewViewer->SetPreviousViewer(contentViewer); > } > ... > mContentViewer = nullptr; Then, here's the place that sets nsDocShell.mContentViewer to non-null value: https://searchfox.org/mozilla-central/rev/11d0ff9f36465ce19b0c43d1ecc3025791eeb808/docshell/base/nsDocShell.cpp#9044 > nsresult > nsDocShell::SetupNewViewer(nsIContentViewer* aNewViewer) > { > ... > mContentViewer = aNewViewer; https://searchfox.org/mozilla-central/rev/11d0ff9f36465ce19b0c43d1ecc3025791eeb808/docshell/base/nsDocShell.cpp#8373 > nsresult > nsDocShell::RestoreFromHistory() > { > ... > nsCOMPtr<nsIContentViewer> viewer; > mLSHE->GetContentViewer(getter_AddRefs(viewer)); > ... > mContentViewer.swap(viewer); the latter one is suspicious. I'll check the order between mContentViewer.swap and destroy.
non-e10s tests got moved to linux32 on treeherder, so this might no more fail on try.
https://treeherder.mozilla.org/#/jobs?repo=try&revision=bbc47847154283c68f27e071eedfd1347f0f0cb2&selectedJob=159009245 it happens also on linux32.
Summary: Some layout/style/test/ tests fail with "ASSERTION: Stop called too early or too late" and "ASSERTION: No document in Destroy()!" on windows non-e10s after bug 1193394 → Some layout/style/test/ tests fail with "ASSERTION: Stop called too early or too late" and "ASSERTION: No document in Destroy()!" on non-e10s after bug 1193394
reproduced the issue locally on macOS by running layout/style/test/test_computed_style_bfcache_display_none.html with non-e10s
and the issue happens after the test finishes. so I think the issue was happening in several tests because it depends on CC timing.
here's flow: 1. nsDocumentViewer::nsDocumentViewer is called 2. nsDocumentViewer::LoadStart is called with mDocument.documentURI=http://mochi.test:8888/tests/layout/style/test/file_computed_style_bfcache_display_none.html 3. the nsDocumentViewer instance is set to nsDocShell.mContentViewer in nsDocShell::SetupNewViewer 4. nsDocumentViewer::Stop is called with mDocument.documentURI=http://mochi.test:8888/tests/layout/style/test/file_computed_style_bfcache_display_none.html 5. nsDocumentViewer::Stop is called with mDocument.documentURI=http://mochi.test:8888/tests/layout/style/test/file_computed_style_bfcache_display_none.html 6. nsDocumentViewer::Close is called documentURI=http://mochi.test:8888/tests/layout/style/test/file_computed_style_bfcache_display_none.html 7. the nsDocumentViewer instance is unset from nsDocShell.mContentViewer in nsDocShell::SetupNewViewer 8. nsDocumentViewer::Destroy is called with mDocument.documentURI=http://mochi.test:8888/tests/layout/style/test/file_computed_style_bfcache_display_none.html 9. the nsDocumentViewer instance is stored to shEntry 10. nsDocumentViewer::ClearHistoryEntry is called with mDocument.documentURI=http://mochi.test:8888/tests/layout/style/test/file_computed_style_bfcache_display_none.html 11. nsDocumentViewer::Destroy is called with mDocument.documentURI=http://mochi.test:8888/tests/layout/style/test/file_computed_style_bfcache_display_none.html 12. destroys mDocument and clears mDocument 13. the nsDocumentViewer instance is set to nsDocShell.mContentViewer in nsDocShell::RestoreFromHistory 14. nsDocumentViewer::Stop is called with mDocument=nullptr 15. nsDocumentViewer::Close is called with mDocument=nullptr 16. nsDocumentViewer::Destroy is called with mDocument=nullptr 17. the nsDocumentViewer instance is unset from nsDocShell.mContentViewer in nsDocShell::Destroy 18. nsDocumentViewer::~nsDocumentViewer is called
the testcase touches history and promise :) https://searchfox.org/mozilla-central/rev/11d0ff9f36465ce19b0c43d1ecc3025791eeb808/layout/style/test/test_computed_style_bfcache_display_none.html#55-58 > function goBack(win) { > return new Promise(resolve => { > win.onpagehide = e => resolve(win); > win.history.back(); > }); > }
Component: Layout → History: Global
Component: History: Global → Document Navigation
Priority: -- → P2
(In reply to Tooru Fujisawa [:arai] from comment #14) > 13. the nsDocumentViewer instance is set to nsDocShell.mContentViewer in > nsDocShell::RestoreFromHistory Inside RestoreFromHitory(), we call FirePageHideNotification(). And then inside the pagehide callback there; (In reply to Tooru Fujisawa [:arai] from comment #15) > test_computed_style_bfcache_display_none.html#55-58 > > function goBack(win) { > > return new Promise(resolve => { > > win.onpagehide = e => resolve(win); > > win.history.back(); > > }); > > } we fulfill the Promise and inside the micro task for the Promise; // Restore the bfcache document. return goBack(w); }).then(() => { // Fetch the style once again. is(w.getComputedStyle(testDiv).opacity, '1'); w.close(); We close the window. So I think what we should do here is to bail out if the doc shell was destroyed after FirePageHideNotification(). A try; https://treeherder.mozilla.org/#/jobs?repo=try&revision=b02b8d2799f991a850dd6b8ac5af8bdc780b156b CCing bz.
So does this same assert reproduce if you just do: win.onpagehide = function() { win.close(); } ? In general, I agree that if FirePageHideNotification() tore us down we should just stop whatever we're doing.
Depends on: 1433921
(In reply to Boris Zbarsky [:bz] (no decent commit message means r-) from comment #17) > So does this same assert reproduce if you just do: > > win.onpagehide = function() { win.close(); } > > ? > > In general, I agree that if FirePageHideNotification() tore us down we > should just stop whatever we're doing. yes, I've filed bug 1433921 for that case (just in case it was critical, but maybe it should be marked dupe now). and I think the patch in comment #16 is reasonable, regardless of the assertion itself is correct (bug 1433921 comment #4)
Yes, that patch looks reasonable to me too.
Thank you both! After some more thought, I think we should return at the top of nsDocShell::Destroy() if we are already destroying the docshell itself because FirePageHideNotification() is also called in Destroy(). Initially I thought we don't need to bail out *after* FirePageHideNotification() in the function since we've been already dying, so it will not be a matter, but now I think we should care the case as well. Also we should return NS_ERROR_DOCSHELL_DYING instead of NS_OK there. I had been trying to write crash tests, but the assertions do not happen unfortunately. So I decided to write mochitest instead, even though the mochitest doesn't fail in the test itself, it just causes the assertions when cycle-collector happens.
Assignee: arai.unmht → hikezoe
Bailing out from nsDocShell::CreateContentViewer() causes memory leak. https://treeherder.mozilla.org/#/jobs?repo=try&revision=cb13a7472e9065a86520d2f3372db6c5a500872f&selectedJob=160032076 We have to nullify |*aContentHandler| when we get NS_ERROR_DOCSHELL_DYING in the call site, i.e. nsDSURIContentListener::DoContent(), since |*aContentHandler| has already allocated when the docshell is destroyed in the pagehide event callback. But still there are another leaks; https://treeherder.mozilla.org/#/jobs?repo=try&revision=39d0198e34b55949ce70acbeb9242ecbcf5ee4be&selectedJob=160053914
(In reply to Hiroyuki Ikezoe (:hiro) from comment #22) > Bailing out from nsDocShell::CreateContentViewer() causes memory leak. > > https://treeherder.mozilla.org/#/ > jobs?repo=try&revision=cb13a7472e9065a86520d2f3372db6c5a500872f&selectedJob=1 > 60032076 > > We have to nullify |*aContentHandler| when we get NS_ERROR_DOCSHELL_DYING in > the call site, i.e. nsDSURIContentListener::DoContent(), since > |*aContentHandler| has already allocated when the docshell is destroyed in > the pagehide event callback. This was wrong. |*ContentHandler| is actually nulled out in the call site [1] (m_targetStreamListener in the call site). And the memory leak is caused by the nulling out. FWIW, the test case caused the memory leak is dom/base/test/test_bug1126851.html. From what I can tell, with the nulling out, shutdown processes for the listeners seem to be skipped and thus memory leak happens. I think we shouldn't null out m_targetStreamListener there and we should let m_targetStreamListener be nulled out in nsDocumentOpenInfo::OnStopRequest() which will be called later since we've already canceled its request in nsDSURIContentListener::DoContent(). Here is a try without the null out m_targetStreamListener there. It looks fine. https://treeherder.mozilla.org/#/jobs?repo=try&revision=c2e645ca7d3660cea9a1005f8b122455acd8419f Also here is a try with all patches for this bug; https://treeherder.mozilla.org/#/jobs?repo=try&revision=e67f9f42e7a60414db22366e2a944f1dcd5cfa62 And a try with the patches and patches for bug 1193394; https://treeherder.mozilla.org/#/jobs?repo=try&revision=4d3a48e951a334a770857a58a52c1753482e4b36 [1] https://hg.mozilla.org/mozilla-central/file/fea9e610ec9d/uriloader/base/nsURILoader.cpp#l750
Comment on attachment 8948117 [details] Bug 1432396 - Call UnblockOnload only if we've already blocked load event. https://reviewboard.mozilla.org/r/217728/#review223762 The API contract is that if doContent returns true the URILoader will _not_ call any methods on aContentHandler. Arguably, having a non-null aContentHandler while returning true is just bogus. This should be fixed in whatever nsIURIContentListener implementations don't handle the contract correctly. Specifically in the nsDSURIContentListener case, what happens if it fails out for a reason other than NS_ERROR_REMOTE_XUL or NS_ERROR_DOCSHELL_DYING? Would it not leak exactly the same way in that case?
Attachment #8948117 - Flags: review?(bzbarsky) → review-
Comment on attachment 8948118 [details] Bug 1432396 - Bail out if the docshell is being destroyed due to pagehide notification. https://reviewboard.mozilla.org/r/217730/#review223766 ::: commit-message-63a68:3 (Diff revision 1) > +Bug 1432396 - Bail out if the docshell is being destroyed due to pagehide notification. r?bz > + > +There are four call site of FirePageHideNotification(). Three of them are "call sites" ::: commit-message-63a68:4 (Diff revision 1) > +Bug 1432396 - Bail out if the docshell is being destroyed due to pagehide notification. r?bz > + > +There are four call site of FirePageHideNotification(). Three of them are > +handled in this patch. The one in nsDocShell::Destroy() will be cared in s/cared/taken care of/ ::: commit-message-63a68:8 (Diff revision 1) > +There are four call site of FirePageHideNotification(). Three of them are > +handled in this patch. The one in nsDocShell::Destroy() will be cared in > +the next patch in this patch series. > + > +Without this fix, the test case in this patch causes assertions when > +cycle-collector happens. "cycle collection".
Attachment #8948118 - Flags: review?(bzbarsky) → review+
Comment on attachment 8948119 [details] Bug 1432396 - Do not process nsDocShell::Destroy() if the docshell is already being destroyed. https://reviewboard.mozilla.org/r/217732/#review223768 ::: docshell/base/nsDocShell.cpp:5431 (Diff revision 1) > NS_ASSERTION(mItemType == typeContent || mItemType == typeChrome, > "Unexpected item type in docshell"); > > AssertOriginAttributesMatchPrivateBrowsing(); > > if (!mIsBeingDestroyed) { This block doesn't need this check anymore, right? It worries me a bit that we would no longer reset the various state we reset right now if we get called a second time. Can any of that state get reinitialized after a call to Destroy? I'm hoping not, but I haven't done any auditing. Have you?
Attachment #8948119 - Flags: review?(bzbarsky) → review+
Thanks for the review! (In reply to Boris Zbarsky [:bz] (no decent commit message means r-) from comment #27) > Comment on attachment 8948117 [details] > Bug 1432396 - Don't null out m_targetStreamListener in the case where > nsDSURIContentListener::DoContent() aborted in > nsDocumentOpenInfo::TryContentListener(). > > https://reviewboard.mozilla.org/r/217728/#review223762 > > The API contract is that if doContent returns true the URILoader will _not_ > call any methods on aContentHandler. Arguably, having a non-null > aContentHandler while returning true is just bogus. > > This should be fixed in whatever nsIURIContentListener implementations don't > handle the contract correctly. Specifically in the nsDSURIContentListener > case, what happens if it fails out for a reason other than > NS_ERROR_REMOTE_XUL or NS_ERROR_DOCSHELL_DYING? Would it not leak exactly > the same way in that case? Yeah, that's fair. I was wondering how I can find such test cases. I could find the case easily with an assertion there. :) I will dig into the case. Thanks! (In reply to Boris Zbarsky [:bz] (no decent commit message means r-) from comment #29) > Comment on attachment 8948119 [details] > Bug 1432396 - Do not process nsDocShell::Destroy() if the docshell is > already being destroyed. > > https://reviewboard.mozilla.org/r/217732/#review223768 > > ::: docshell/base/nsDocShell.cpp:5431 > (Diff revision 1) > > NS_ASSERTION(mItemType == typeContent || mItemType == typeChrome, > > "Unexpected item type in docshell"); > > > > AssertOriginAttributesMatchPrivateBrowsing(); > > > > if (!mIsBeingDestroyed) { > > This block doesn't need this check anymore, right? > > It worries me a bit that we would no longer reset the various state we reset > right now if we get called a second time. Can any of that state get > reinitialized after a call to Destroy? > > I'm hoping not, but I haven't done any auditing. Have you? I haven't. I will try to do it on try with an additional assertion, I hope there are some automation test cases. Thanks for the review!
(In reply to Hiroyuki Ikezoe (:hiro) from comment #30) > (In reply to Boris Zbarsky [:bz] (no decent commit message means r-) from > comment #27) > > Comment on attachment 8948117 [details] > > Bug 1432396 - Don't null out m_targetStreamListener in the case where > > nsDSURIContentListener::DoContent() aborted in > > nsDocumentOpenInfo::TryContentListener(). > > > > https://reviewboard.mozilla.org/r/217728/#review223762 > > > > The API contract is that if doContent returns true the URILoader will _not_ > > call any methods on aContentHandler. Arguably, having a non-null > > aContentHandler while returning true is just bogus. > > > > This should be fixed in whatever nsIURIContentListener implementations don't > > handle the contract correctly. Specifically in the nsDSURIContentListener > > case, what happens if it fails out for a reason other than > > NS_ERROR_REMOTE_XUL or NS_ERROR_DOCSHELL_DYING? Would it not leak exactly > > the same way in that case? > > Yeah, that's fair. I was wondering how I can find such test cases. I could > find the case easily with an assertion there. :) > I will dig into the case. Thanks! The assertion I used for find the case was not good. The cases I found causes NS_ERROR_REMOTE_XUL or NS_ERROR_DOCSHELL_DYING but didn't allocate aContentHandler at all. I did push another try with the assertion that checks aContentHandler is allocated in the failure cases. https://treeherder.mozilla.org/#/jobs?repo=try&revision=4e295cd57769cbef1cc01096802579b9db08e0e4
The leak reason is that I did not call nsDocumentViewer::Stop() for the newly created content viewer. Adding 'viewer->Stop()' just before returning NS_ERROR_DOCSHELL_DYING stops the leak. But with the call an assertion[1] in nsDocument::UnblockOnload() happens because when we bail out nsDocShell::CreateContentViewer after FirePageHideNotification(), we haven't yet called BlockOnload(). We need a tweak for the case. [1] https://hg.mozilla.org/mozilla-central/file/8cc2427a322c/dom/base/nsDocument.cpp#l8511
(In reply to Hiroyuki Ikezoe (:hiro) from comment #32) > The leak reason is that I did not call nsDocumentViewer::Stop() for the > newly created content viewer. Adding 'viewer->Stop()' just before returning > NS_ERROR_DOCSHELL_DYING stops the leak. But with the call an assertion[1] > in nsDocument::UnblockOnload() happens because when we bail out > nsDocShell::CreateContentViewer after FirePageHideNotification(), we haven't > yet called BlockOnload(). We need a tweak for the case. I decided to skip calling UnblockOnload() in nsContentSink::DropParserAndPerfHint() if we haven't started loading. Also to audit that we don't re-initialzie the variables which were reset in nsDocShell::Destroy() I decided to add assertions in all places which set the variable again. While I was checking the places, I noticed that we should bail out nsDocShell::CreateContentViewer() at top of the function if the docshell is already being destroyed since mLoadingURI, which is cleared in Destroy(), is assigned there. Here is a try with these changes; https://treeherder.mozilla.org/#/jobs?repo=try&revision=3696e5b774644b1c6d168b6c67edee1bfe3be365
I'm sorry for the lag here. I need to think through these changes carefully.... Hopefully on Monday.
No worries. I appreciate your careful comprehensive reviews.
Comment on attachment 8948117 [details] Bug 1432396 - Call UnblockOnload only if we've already blocked load event. https://reviewboard.mozilla.org/r/217728/#review226274 ::: dom/base/nsContentSink.cpp:1574 (Diff revision 2) > - if (!mRunsToCompletion) { > + // Call UnblockOnload only if mRunsToComletion is false and if > + // we have already started loading because it's possible that this function > + // is called (i.e. the parser is terminated) before start loading due to > + // destroying the window inside unload event callbacks for the previous > + // document. > + if (!mRunsToCompletion && mBeginLoadTime) { mBeginLoadTime is an interval time. It can randomly be 0 any time. We should just have a boolean member we set when we block onload that we check here.
Attachment #8948117 - Flags: review?(bzbarsky) → review-
Comment on attachment 8949320 [details] Bug 1432396 - Check the docshell is being destroyed along with the tree owner at the top of nsDocShell::CreateContentViewer(). https://reviewboard.mozilla.org/r/218704/#review226276
Attachment #8949320 - Flags: review?(bzbarsky) → review+
Comment on attachment 8949321 [details] Bug 1432396 - Stop the newly create orphaned viewer when the docshell is destroyed in nsDocShell::CreateContentViewer(). https://reviewboard.mozilla.org/r/218706/#review226278 ::: commit-message-c592a:1 (Diff revision 1) > +Bug 1432396 - Force to stop the newly create orphaned content viewer when the docshell is destroyed in nsDocShell::CreateContentViewer(). r?bz "Bug 1432396 - Stop the newly created orphaned viewer when the docshell is destroyed in ..." ::: commit-message-c592a:3 (Diff revision 1) > +Bug 1432396 - Force to stop the newly create orphaned content viewer when the docshell is destroyed in nsDocShell::CreateContentViewer(). r?bz > + > +Normally the docshell stop the content viewer in nsDocShell::Stop(), but in this "stops the content viewer" ::: commit-message-c592a:4 (Diff revision 1) > +Bug 1432396 - Force to stop the newly create orphaned content viewer when the docshell is destroyed in nsDocShell::CreateContentViewer(). r?bz > + > +Normally the docshell stop the content viewer in nsDocShell::Stop(), but in this > +case it won't be stopped in the function since the new content viewer has never "in that function" ::: commit-message-c592a:5 (Diff revision 1) > +Bug 1432396 - Force to stop the newly create orphaned content viewer when the docshell is destroyed in nsDocShell::CreateContentViewer(). r?bz > + > +Normally the docshell stop the content viewer in nsDocShell::Stop(), but in this > +case it won't be stopped in the function since the new content viewer has never > +associated with this docshell. "been associated" ::: commit-message-c592a:8 (Diff revision 1) > +Normally the docshell stop the content viewer in nsDocShell::Stop(), but in this > +case it won't be stopped in the function since the new content viewer has never > +associated with this docshell. > + > +dom/base/test/test_bug1126851.html is a test case that we bail out > +CreateContentViewer() due to win.close() in an unload event callback. "from CreateContentViewer()" ::: docshell/base/nsDocShell.cpp:8745 (Diff revision 1) > nsCOMPtr<nsIChannel> aOpenedChannel = do_QueryInterface(aRequest); > if (aOpenedChannel) { > aOpenedChannel->GetURI(getter_AddRefs(mLoadingURI)); > } > FirePageHideNotification(!mSavingOldViewer); > + if (mIsBeingDestroyed) { So here's my question. Why are we doing this _after_ creating the new viewer? Seems to me like it would be saner to move this unload event hiring bit to before we create the new viewer and its parser and all that. We do use the new viewer's document to call CanSavePresentation. But we only need that for the WouldReuseInnerWindow call. And all that needs from the new document is the principal. We could have a version of WouldReuseInnerWindow that takes a principal (the channel result principal) or a channel... That seems saner to me, in general, than creating a new viewer and then trying to unwind its creation. That said, doing that in a followup should be fine. For now we can go with this approach.
Attachment #8949321 - Flags: review?(bzbarsky) → review+
Comment on attachment 8949322 [details] Bug 1432396 - Add assertions that we don't allow reinitialization of variables that were reset in nsDocShell::Destroy(). https://reviewboard.mozilla.org/r/218708/#review226282 r=me. Thank you for going through and auditing this! ::: commit-message-edc10:1 (Diff revision 1) > +Bug 1432396 - Add assertions that we don't allow reinitialize variables that were reset in nsDocShell::Destroy(). r?bz "reinitialization of variables"? ::: commit-message-edc10:3 (Diff revision 1) > +Bug 1432396 - Add assertions that we don't allow reinitialize variables that were reset in nsDocShell::Destroy(). r?bz > + > +Here is the list for variables which are reset in nsDocShell::Destroy(). "of variables"
Attachment #8949322 - Flags: review?(bzbarsky) → review+
(In reply to Boris Zbarsky [:bz] (no decent commit message means r-) from comment #42) > Comment on attachment 8948117 [details] > Bug 1432396 - Call UnblockOnload only if we've already started loading. > > https://reviewboard.mozilla.org/r/217728/#review226274 > > ::: dom/base/nsContentSink.cpp:1574 > (Diff revision 2) > > - if (!mRunsToCompletion) { > > + // Call UnblockOnload only if mRunsToComletion is false and if > > + // we have already started loading because it's possible that this function > > + // is called (i.e. the parser is terminated) before start loading due to > > + // destroying the window inside unload event callbacks for the previous > > + // document. > > + if (!mRunsToCompletion && mBeginLoadTime) { > > mBeginLoadTime is an interval time. It can randomly be 0 any time. > > We should just have a boolean member we set when we block onload that we > check here. Oh I see. I will add the flag there. Thanks! > ::: docshell/base/nsDocShell.cpp:8745 > (Diff revision 1) > > nsCOMPtr<nsIChannel> aOpenedChannel = do_QueryInterface(aRequest); > > if (aOpenedChannel) { > > aOpenedChannel->GetURI(getter_AddRefs(mLoadingURI)); > > } > > FirePageHideNotification(!mSavingOldViewer); > > + if (mIsBeingDestroyed) { > > So here's my question. Why are we doing this _after_ creating the new > viewer? Seems to me like it would be saner to move this unload event hiring > bit to before we create the new viewer and its parser and all that. > > We do use the new viewer's document to call CanSavePresentation. But we > only need that for the WouldReuseInnerWindow call. And all that needs from > the new document is the principal. We could have a version of > WouldReuseInnerWindow that takes a principal (the channel result principal) > or a channel... That seems saner to me, in general, than creating a new > viewer and then trying to unwind its creation. Ah indeed. Though I've never thought it, it sounds saner for me too. I will file a followup bug for it. Thanks!
Comment on attachment 8948117 [details] Bug 1432396 - Call UnblockOnload only if we've already blocked load event. https://reviewboard.mozilla.org/r/217728/#review226286 Thank you for the fast update! ::: commit-message-92b61:1 (Diff revision 3) > +Bug 1432396 - Call UnblockOnload only if we've already blocked onload event. r?bz s/onload event/load event/ ::: dom/base/nsContentSink.h:313 (Diff revision 3) > // since we're not longer updating our child counts. > uint8_t mIsDocumentObserver : 1; > // True if this is parser is a fragment parser or an HTML DOMParser. > // XML DOMParser leaves this to false for now! > uint8_t mRunsToCompletion : 1; > + // True if we are blocking onload event. "load event" ::: dom/base/nsContentSink.cpp:1572 (Diff revision 3) > FavorPerformanceHint(true, 0); > } > > - if (!mRunsToCompletion) { > + // Call UnblockOnload only if mRunsToComletion is false and if > + // we have already started loading because it's possible that this function > + // is called (i.e. the parser is terminated) before start loading due to "before we start loading"
Attachment #8948117 - Flags: review?(bzbarsky) → review+
It turns out that nsDocShell::EnsureTransferableHookData() gets called while the docshell being destroyed through nsDocShell::GetInterface() triggered by blur event on MacOSX. I filed bug 1438397 for that.
Depends on: 1438397
Depends on: 1438440
I've filed bug 1438440 for the issue that nsDocShell::SetTreeOwner() is called during the docshell is being destroyed. But after some more thought, it's inevitable since SetTreeOwner is called through browser.setAttribute("primary", "true") in script. So I've decided to change the assertion in SetTreeOwner() to early return in the last patch.
(In reply to Boris Zbarsky [:bz] (no decent commit message means r-) from comment #44) > ::: docshell/base/nsDocShell.cpp:8745 > (Diff revision 1) > > nsCOMPtr<nsIChannel> aOpenedChannel = do_QueryInterface(aRequest); > > if (aOpenedChannel) { > > aOpenedChannel->GetURI(getter_AddRefs(mLoadingURI)); > > } > > FirePageHideNotification(!mSavingOldViewer); > > + if (mIsBeingDestroyed) { > > So here's my question. Why are we doing this _after_ creating the new > viewer? Seems to me like it would be saner to move this unload event hiring > bit to before we create the new viewer and its parser and all that. > > We do use the new viewer's document to call CanSavePresentation. But we > only need that for the WouldReuseInnerWindow call. And all that needs from > the new document is the principal. We could have a version of > WouldReuseInnerWindow that takes a principal (the channel result principal) > or a channel... That seems saner to me, in general, than creating a new > viewer and then trying to unwind its creation. > > That said, doing that in a followup should be fine. For now we can go with > this approach. Filed bug 1438709.
No longer depends on: 1438440
Pushed by hikezoe@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/62c3218a0921 Call UnblockOnload only if we've already blocked load event. r=bz https://hg.mozilla.org/integration/autoland/rev/9a74a8c4a8c0 Check the docshell is being destroyed along with the tree owner at the top of nsDocShell::CreateContentViewer(). r=bz https://hg.mozilla.org/integration/autoland/rev/b78cfbdf3cca Bail out if the docshell is being destroyed due to pagehide notification. r=bz https://hg.mozilla.org/integration/autoland/rev/9446148c32a3 Stop the newly create orphaned viewer when the docshell is destroyed in nsDocShell::CreateContentViewer(). r=bz https://hg.mozilla.org/integration/autoland/rev/f0f5a81b193f Do not process nsDocShell::Destroy() if the docshell is already being destroyed. r=bz https://hg.mozilla.org/integration/autoland/rev/57abd8e4ab25 Add assertions that we don't allow reinitialization of variables that were reset in nsDocShell::Destroy(). r=bz
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: