Closed Bug 1451172 Opened 6 years ago Closed 6 years ago

Assertion failure: JS_IsExceptionPending(cx), at /builds/worker/workspace/build/src/obj-firefox/dom/bindings/EventListenerBinding.cpp:26

Categories

(Core :: DOM: Core & HTML, defect, P2)

Product:
Core
Component:
DOM: Core & HTML
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla63
Tracking Flags:
Tracking Status
firefox-esr52 --- unaffected
firefox-esr60 --- unaffected
firefox61 --- unaffected
firefox62 --- wontfix
firefox63 --- fixed

People

(Reporter: intermittent-bug-filer, Assigned: smaug)

References

Details

(Keywords: crash, intermittent-failure, Whiteboard: [stockwell unknown])

Crash Data

Attachments

(1 file)

fallback_to_current_global.diff
738 bytes, patch
bzbarsky
: review+
RyanVM
: approval-mozilla-beta-
Details | Diff | Splinter Review 
Filed by: apavel [at] mozilla.com

https://treeherder.mozilla.org/logviewer.html#?job_id=171740829&repo=autoland

https://queue.taskcluster.net/v1/task/GwNF_ygcQGCgQJxuOzDqyQ/runs/0/artifacts/public/logs/live_backing.log

[task 2018-04-03T23:12:06.040Z] 23:12:06     INFO - GECKO(1047) | Assertion failure: JS_IsExceptionPending(cx), at /builds/worker/workspace/build/src/obj-firefox/dom/bindings/EventListenerBinding.cpp:26
[task 2018-04-03T23:12:33.231Z] 23:12:33     INFO - GECKO(1047) | #01: mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*> [s3:gecko-generated-sources:0502cca494d7ae0441ada14535523caade9340fdd09934cf6d31cc421267c319ae3d6f5b43b2730d0b36ae1c87480f3b426c5fa4fec57d51047d83a51acde602/dist/include/mozilla/dom/EventListenerBinding.h::61]
[task 2018-04-03T23:12:33.231Z] 23:12:33     INFO - 
[task 2018-04-03T23:12:33.233Z] 23:12:33     INFO - GECKO(1047) | #02: mozilla::EventListenerManager::HandleEventSubType [dom/events/EventListenerManager.cpp:1088]
[task 2018-04-03T23:12:33.235Z] 23:12:33     INFO - 
[task 2018-04-03T23:12:33.236Z] 23:12:33     INFO - GECKO(1047) | #03: mozilla::EventListenerManager::HandleEventInternal [dom/events/EventListenerManager.cpp:1259]
[task 2018-04-03T23:12:33.237Z] 23:12:33     INFO - 
[task 2018-04-03T23:12:33.239Z] 23:12:33     INFO - GECKO(1047) | #04: mozilla::EventTargetChainItem::HandleEvent [dom/events/EventListenerManager.h:376]
[task 2018-04-03T23:12:33.241Z] 23:12:33     INFO - 
[task 2018-04-03T23:12:33.242Z] 23:12:33     INFO - GECKO(1047) | #05: mozilla::EventTargetChainItem::HandleEventTargetChain [dom/events/EventDispatcher.cpp:559]
[task 2018-04-03T23:12:33.244Z] 23:12:33     INFO - 
[task 2018-04-03T23:12:33.246Z] 23:12:33     INFO - GECKO(1047) | #06: mozilla::EventDispatcher::Dispatch [dom/events/EventDispatcher.cpp:923]
[task 2018-04-03T23:12:33.247Z] 23:12:33     INFO - 
[task 2018-04-03T23:12:33.249Z] 23:12:33     INFO - GECKO(1047) | #07: mozilla::EventDispatcher::DispatchDOMEvent [dom/events/EventDispatcher.cpp:1000]
[task 2018-04-03T23:12:33.250Z] 23:12:33     INFO - 
[task 2018-04-03T23:12:33.251Z] 23:12:33     INFO - GECKO(1047) | #08: nsINode::DispatchEvent [dom/base/nsINode.cpp:1175]
[task 2018-04-03T23:12:33.252Z] 23:12:33     INFO - 
[task 2018-04-03T23:12:33.254Z] 23:12:33     INFO - GECKO(1047) | #09: mozilla::AsyncEventDispatcher::Run [dom/events/AsyncEventDispatcher.cpp:59]
[task 2018-04-03T23:12:33.255Z] 23:12:33     INFO - 
[task 2018-04-03T23:12:33.256Z] 23:12:33     INFO - GECKO(1047) | #10: nsThread::ProcessNextEvent [xpcom/threads/nsThread.cpp:1100]

[task 2018-04-03T23:12:33.365Z] 23:12:33     INFO - 
[task 2018-04-03T23:12:33.366Z] 23:12:33     INFO - GECKO(1047) | #10: libc.so.6 + 0x10741d
[task 2018-04-03T23:12:33.366Z] 23:12:33     INFO - 
[task 2018-04-03T23:12:33.367Z] 23:12:33     INFO - GECKO(1047) | #11: ??? (???:???)
[task 2018-04-03T23:12:33.383Z] 23:12:33     INFO - TEST-INFO | Main app process: exit 11
[task 2018-04-03T23:12:33.384Z] 23:12:33     INFO - Buffered messages finished
[task 2018-04-03T23:12:33.385Z] 23:12:33    ERROR - TEST-UNEXPECTED-FAIL | accessible/tests/mochitest/elm/test_MathMLSpec.html | application terminated with exit code 11
[task 2018-04-03T23:12:33.386Z] 23:12:33     INFO - runtests.py | Application ran for: 0:01:07.205097
[task 2018-04-03T23:12:33.386Z] 23:12:33     INFO - zombiecheck | Reading PID log: /tmp/tmp1zYB4lpidlog
[task 2018-04-03T23:12:33.387Z] 23:12:33     INFO - ==> process 1047 launched child process 1067
[task 2018-04-03T23:12:33.388Z] 23:12:33     INFO - ==> process 1047 launched child process 1143
[task 2018-04-03T23:12:33.389Z] 23:12:33     INFO - zombiecheck | Checking for orphan process with PID: 1067
[task 2018-04-03T23:12:33.389Z] 23:12:33     INFO - zombiecheck | Checking for orphan process with PID: 1143
[task 2018-04-03T23:12:33.390Z] 23:12:33     INFO - mozcrash Copy/paste: /usr/local/bin/linux64-minidump_stackwalk /tmp/tmpMpQO7V.mozrunner/minidumps/00cc0506-5300-9c86-bc67-b92f0b98b252.dmp /builds/worker/workspace/build/symbols
[task 2018-04-03T23:12:39.289Z] 23:12:39     INFO - mozcrash Saved minidump as /builds/worker/workspace/build/blobber_upload_dir/00cc0506-5300-9c86-bc67-b92f0b98b252.dmp
[task 2018-04-03T23:12:39.290Z] 23:12:39     INFO - mozcrash Saved app info as /builds/worker/workspace/build/blobber_upload_dir/00cc0506-5300-9c86-bc67-b92f0b98b252.extra
[task 2018-04-03T23:12:39.447Z] 23:12:39     INFO - PROCESS-CRASH | accessible/tests/mochitest/elm/test_MathMLSpec.html | application crashed [@ mozilla::dom::EventListener::HandleEvent]
[task 2018-04-03T23:12:39.448Z] 23:12:39     INFO - Crash dump filename: /tmp/tmpMpQO7V.mozrunner/minidumps/00cc0506-5300-9c86-bc67-b92f0b98b252.dmp
[task 2018-04-03T23:12:39.448Z] 23:12:39     INFO - Operating system: Linux
[task 2018-04-03T23:12:39.449Z] 23:12:39     INFO -                   0.0.0 Linux 4.4.0-1014-aws #14taskcluster-Ubuntu SMP Mon Feb 19 11:31:26 UTC 2018 x86_64
[task 2018-04-03T23:12:39.450Z] 23:12:39     INFO - CPU: amd64
[task 2018-04-03T23:12:39.452Z] 23:12:39     INFO -      family 6 model 62 stepping 4
[task 2018-04-03T23:12:39.452Z] 23:12:39     INFO -      2 CPUs
[task 2018-04-03T23:12:39.453Z] 23:12:39     INFO - 
[task 2018-04-03T23:12:39.453Z] 23:12:39     INFO - GPU: UNKNOWN
[task 2018-04-03T23:12:39.453Z] 23:12:39     INFO - 
[task 2018-04-03T23:12:39.454Z] 23:12:39     INFO - Crash reason:  SIGSEGV
[task 2018-04-03T23:12:39.454Z] 23:12:39     INFO - Crash address: 0x0
[task 2018-04-03T23:12:39.454Z] 23:12:39     INFO - Process uptime: not available
[task 2018-04-03T23:12:39.454Z] 23:12:39     INFO - 
[task 2018-04-03T23:12:39.454Z] 23:12:39     INFO - Thread 0 (crashed)
[task 2018-04-03T23:12:39.455Z] 23:12:39     INFO -  0  libxul.so!mozilla::dom::EventListener::HandleEvent [EventListenerBinding.cpp: : 26 + 0x18]
[task 2018-04-03T23:12:39.455Z] 23:12:39     INFO -     rax = 0x0000000000000000   rdx = 0x0000000000000000
[task 2018-04-03T23:12:39.456Z] 23:12:39     INFO -     rcx = 0x00007f8da5d532dd   rbx = 0x00007ffcd2ed7648
[task 2018-04-03T23:12:39.456Z] 23:12:39     INFO -     rsi = 0x00007f8da6022770   rdi = 0x00007f8da6021540
[task 2018-04-03T23:12:39.457Z] 23:12:39     INFO -     rbp = 0x00007ffcd2ed7700   rsp = 0x00007ffcd2ed75c0
[task 2018-04-03T23:12:39.457Z] 23:12:39     INFO -      r8 = 0x00007f8da6022770    r9 = 0x00007f8da70ec740
[task 2018-04-03T23:12:39.458Z] 23:12:39     INFO -     r10 = 0x000000000000004c   r11 = 0x0000000000000000
[task 2018-04-03T23:12:39.458Z] 23:12:39     INFO -     r12 = 0x00007f8d61437460   r13 = 0x00007f8d7a69f7c0
[task 2018-04-03T23:12:39.458Z] 23:12:39     INFO -     r14 = 0x00007ffcd2ed7960   r15 = 0x00007ffcd2ed7600
[task 2018-04-03T23:12:39.459Z] 23:12:39     INFO -     rip = 0x00007f8d9580bdca
[task 2018-04-03T23:12:39.459Z] 23:12:39     INFO -     Found by: given as instruction pointer in context
[task 2018-04-03T23:12:39.460Z] 23:12:39     INFO -  1  libxul.so!mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*> [EventListenerBinding.h: : 66 + 0x1c]
[task 2018-04-03T23:12:39.460Z] 23:12:39     INFO -     rbp = 0x00007ffcd2ed7920   rsp = 0x00007ffcd2ed7710
[task 2018-04-03T23:12:39.460Z] 23:12:39     INFO -     rip = 0x00007f8d95b40dfb
[task 2018-04-03T23:12:39.461Z] 23:12:39     INFO -     Found by: previous frame's frame pointer
[task 2018-04-03T23:12:39.461Z] 23:12:39     INFO -  2  libxul.so!mozilla::EventListenerManager::HandleEventSubType [EventListenerManager.cpp:363cd8bba7744e99cc7de66a9b89a3617551334e : 1087 + 0x36]
[task 2018-04-03T23:12:39.461Z] 23:12:39     INFO -     rbp = 0x00007ffcd2ed79a0   rsp = 0x00007ffcd2ed7930
[task 2018-04-03T23:12:39.462Z] 23:12:39     INFO -     rip = 0x00007f8d95b41b88
[task 2018-04-03T23:12:39.462Z] 23:12:39     INFO -     Found by: previous frame's frame pointer
[task 2018-04-03T23:12:39.463Z] 23:12:39     INFO -  3  libxul.so!mozilla::EventListenerManager::HandleEventInternal [EventListenerManager.cpp:363cd8bba7744e99cc7de66a9b89a3617551334e : 1259 + 0x19]
[task 2018-04-03T23:12:39.463Z] 23:12:39     INFO -     rbp = 0x00007ffcd2ed7c10   rsp = 0x00007ffcd2ed79b0
[task 2018-04-03T23:12:39.463Z] 23:12:39     INFO -     rip = 0x00007f8d95b441cb
[task 2018-04-03T23:12:39.464Z] 23:12:39     INFO -     Found by: previous frame's frame pointer
[task 2018-04-03T23:12:39.464Z] 23:12:39     INFO -  4  libxul.so!mozilla::EventTargetChainItem::HandleEvent [EventListenerManager.h:363cd8bba7744e99cc7de66a9b89a3617551334e : 376 + 0xa]
[task 2018-04-03T23:12:39.465Z] 23:12:39     INFO -     rbp = 0x00007ffcd2ed7c40   rsp = 0x00007ffcd2ed7c20
[task 2018-04-03T23:12:39.465Z] 23:12:39     INFO -     rip = 0x00007f8d95b4473a
[task 2018-04-03T23:12:39.465Z] 23:12:39     INFO -     Found by: previous frame's frame pointer
[task 2018-04-03T23:12:39.467Z] 23:12:39     INFO -  5  libxul.so!mozilla::EventTargetChainItem::HandleEventTargetChain [EventDispatcher.cpp:363cd8bba7744e99cc7de66a9b89a3617551334e : 559 + 0xf]
[task 2018-04-03T23:12:39.467Z] 23:12:39     INFO -     rbp = 0x00007ffcd2ed7cc0   rsp = 0x00007ffcd2ed7c50
[task 2018-04-03T23:12:39.467Z] 23:12:39     INFO -     rip = 0x00007f8d95b44a83
[task 2018-04-03T23:12:39.467Z] 23:12:39     INFO -     Found by: previous frame's frame pointer
[task 2018-04-03T23:12:39.468Z] 23:12:39     INFO -  6  libxul.so!mozilla::EventDispatcher::Dispatch [EventDispatcher.cpp:363cd8bba7744e99cc7de66a9b89a3617551334e : 918 + 0xb]
[task 2018-04-03T23:12:39.468Z] 23:12:39     INFO -     rbp = 0x00007ffcd2ed7e00   rsp = 0x00007ffcd2ed7cd0
[task 2018-04-03T23:12:39.468Z] 23:12:39     INFO -     rip = 0x00007f8d95b45490
[task 2018-04-03T23:12:39.470Z] 23:12:39     INFO -     Found by: previous frame's frame pointer
[task 2018-04-03T23:12:39.470Z] 23:12:39     INFO -  7  libxul.so!mozilla::EventDispatcher::DispatchDOMEvent [EventDispatcher.cpp:363cd8bba7744e99cc7de66a9b89a3617551334e : 1000 + 0x19]
[task 2018-04-03T23:12:39.471Z] 23:12:39     INFO -     rbp = 0x00007ffcd2ed7e60   rsp = 0x00007ffcd2ed7e10
[task 2018-04-03T23:12:39.471Z] 23:12:39     INFO -     rip = 0x00007f8d95b4584f
[task 2018-04-03T23:12:39.477Z] 23:12:39     INFO -     Found by: previous frame's frame pointer
[task 2018-04-03T23:12:39.479Z] 23:12:39     INFO -  8  libxul.so!nsINode::DispatchEvent [nsINode.cpp:363cd8bba7744e99cc7de66a9b89a3617551334e : 1174 + 0x5]
[task 2018-04-03T23:12:39.479Z] 23:12:39     INFO -     rbp = 0x00007ffcd2ed7ec0   rsp = 0x00007ffcd2ed7e70
[task 2018-04-03T23:12:39.479Z] 23:12:39     INFO -     rip = 0x00007f8d952346ed
[task 2018-04-03T23:12:39.479Z] 23:12:39     INFO -     Found by: previous frame's frame pointer
[task 2018-04-03T23:12:39.480Z] 23:12:39     INFO -  9  libxul.so!mozilla::AsyncEventDispatcher::Run [AsyncEventDispatcher.cpp:363cd8bba7744e99cc7de66a9b89a3617551334e : 70 + 0x1b]
[task 2018-04-03T23:12:39.480Z] 23:12:39     INFO -     rbp = 0x00007ffcd2ed7fb0   rsp = 0x00007ffcd2ed7ed0
[task 2018-04-03T23:12:39.481Z] 23:12:39     INFO -     rip = 0x00007f8d95b21e4e
[task 2018-04-03T23:12:39.481Z] 23:12:39     INFO -     Found by: previous frame's frame pointer
[task 2018-04-03T23:12:39.482Z] 23:12:39     INFO - 10  libxul.so!nsThread::ProcessNextEvent [nsThread.cpp:363cd8bba7744e99cc7de66a9b89a3617551334e : 1096 + 0x15]
[task 2018-04-03T23:12:39.482Z] 23:12:39     INFO -     rbp = 0x00007ffcd2ed8590   rsp = 0x00007ffcd2ed7fc0
[task 2018-04-03T23:12:39.482Z] 23:12:39     INFO -     rip = 0x00007f8d94602b12
[task 2018-04-03T23:12:39.482Z] 23:12:39     INFO -     Found by: previous frame's frame pointer
Summary: Intermittent accessible/tests/mochitest/elm/test_MathMLSpec.html | application crashed [@ mozilla::dom::EventListener::HandleEvent] after Assertion failure: JS_IsExceptionPending(cx) → Assertion failure: JS_IsExceptionPending(cx), at /builds/worker/workspace/build/src/obj-firefox/dom/bindings/EventListenerBinding.cpp:26
It doesn't seem a11y one. Moving to DOM component, where asserting EventListener resides
Component: Disability Access APIs → DOM
So the proximate cause of the assert is that the event we are dispatching has an mOwner that is an nsGlobalWindowInner which has been torn down, such that its mWrapper is null.  Then when we land in the nsIGlobalObject* overload of FindAssociatedGlobal we do:

  if (!p) {
    return JS::CurrentGlobalOrNull(cx);
  }

  JSObject* global = p->GetGlobalJSObject();
  if (!global) {
    return nullptr;
  }

which returns null.  That propagates out to Event_Binding::Wrap, which returns false due to failure to FindAssociatedGlobal, which then propagates out through GetOrCreateDOMReflector to the assertion point in EventListener::HandleEvent.

The event we're firing is being fired via AsyncEventDispatcher and is an "UnselectedTabHover:Disable" event.  

It looks to me that the window was already torn down by the time BackgroundVideoDecodingPermissionObserver::DisableEvent ran.  At that point, doc->GetScopeObject() returns an inner window with no wrapper.  And this->GetOwnerWindow() returns null.

The stack to the point where we create that AsyncEventDispatcher looks like this:

#0  mozilla::AsyncEventDispatcher::AsyncEventDispatcher (this=0x796919a0, aTarget=0x53d82f838000, aEventType=..., aBubbles=true, aOnlyChromeDispatch=true) at /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/AsyncEventDispatcher.h:37
#1  0x0000000072f0a5b3 in mozilla::BackgroundVideoDecodingPermissionObserver::DisableEvent (this=<optimized out>) at /builds/worker/workspace/build/src/dom/media/BackgroundVideoDecodingPermissionObserver.cpp:133
#2  0x0000000072f1058b in mozilla::BackgroundVideoDecodingPermissionObserver::UnregisterEvent (this=0x7f1e8257c550) at /builds/worker/workspace/build/src/dom/media/BackgroundVideoDecodingPermissionObserver.cpp:94
#3  0x0000000072f82e88 in mozilla::MediaDecoder::Shutdown (this=this@entry=0x525181a5e00) at /builds/worker/workspace/build/src/dom/media/MediaDecoder.cpp:323
#4  0x0000000072f248f4 in mozilla::ChannelMediaDecoder::Shutdown (this=0x525181a5e00) at /builds/worker/workspace/build/src/dom/media/ChannelMediaDecoder.cpp:268
#5  0x0000000072e96008 in mozilla::dom::HTMLMediaElement::ShutdownDecoder (this=this@entry=0x766f71f61800) at /builds/worker/workspace/build/src/dom/html/HTMLMediaElement.cpp:1732
#6  0x0000000072ea1827 in mozilla::dom::HTMLMediaElement::~HTMLMediaElement (this=0x766f71f61800, __in_chrg=<optimized out>) at /builds/worker/workspace/build/src/dom/html/HTMLMediaElement.cpp:3885
#7  0x0000000072e5793f in mozilla::dom::HTMLAudioElement::~HTMLAudioElement (this=0x766f71f61800, __in_chrg=<optimized out>) at /builds/worker/workspace/build/src/dom/html/HTMLAudioElement.cpp:36
#8  0x0000000072e57959 in mozilla::dom::HTMLAudioElement::~HTMLAudioElement (this=0x766f71f61800, __in_chrg=<optimized out>) at /builds/worker/workspace/build/src/dom/html/HTMLAudioElement.cpp:39
#9  0x000000007182b9e6 in SnowWhiteKiller::~SnowWhiteKiller (this=this@entry=0x7ffd8e8c1fa0, __in_chrg=<optimized out>) at /builds/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:2729
#10 0x000000007182bfe5 in RemoveSkippableVisitor::~RemoveSkippableVisitor (this=0x7ffd8e8c1fa0, __in_chrg=<optimized out>) at /builds/worker/workspace/build/src/xpcom/base/nsCycleCollector.cpp:2833

so we're way into killing off this node and its document, and certainly shouldn't be firing events by this point.

Olli, should we be doing something in AsyncEventDispatcher to prevent firing the event if the event's putative global is gone like this?

Chris, should this code really be trying to fire an event with that stack?  Seems pretty fishy...
Flags: needinfo?(cpearce)
Flags: needinfo?(bugs)
Oh, and maybe we should fall back to the current global if the nsIGlobalObject is torn down like this in FindAssociatedGlobal...
Media code here certainly looks rather weird.

I'm not so sure about AsyncEventDispatcher. Since it should just work, given that events are used also as a communication channel between content and chrome and so.
I think I'd prefer if FindAssociatedGlobal would fall back to current global.
Flags: needinfo?(bugs)
Alwu wrote this code, so I'll defer this to him...

Can we assume that the browser object in chrome code is being destroyed too?
Flags: needinfo?(cpearce) → needinfo?(alwu)
The disable event should only be dispatched if the Chrome browser exists. That event is used to notify the Chrome browser that you don't need to send any tab-hover event afterward [1].

Although I don't really understand the relationship between the Chrome browser and outer window, could we assume they're in same lifetime? 

If so, we could add the null check for outer window in Enable/DisableEvent() [2].

[1] https://searchfox.org/mozilla-central/rev/51268dcbdff0f6f4a5cff7986df0f616efc5bcfd/toolkit/content/widgets/browser.xml#725
[2] https://searchfox.org/mozilla-central/rev/51268dcbdff0f6f4a5cff7986df0f616efc5bcfd/dom/media/BackgroundVideoDecodingPermissionObserver.cpp#122
Flags: needinfo?(alwu) → needinfo?(bugs)
> Can we assume that the browser object in chrome code is being destroyed too?

No.

> could we assume they're in same lifetime? 

No, in the sense that the chrome <browser> can get removed from the DOM and continue to exist as an object while the outer window inside it will be destroyed.

However, if you can't reach the outer window from the document, then you can't reach the chrome <browser> either and there's no point in firing the event.
Blocks: 1397297
So, perhaps this?
Flags: needinfo?(bugs)
Attachment #8998240 - Flags: review?(bzbarsky)
See Also: → 1481629
(the patch looks rather promising from bug 1397297's point of view)
Comment on attachment 8998240 [details] [diff] [review]
fallback_to_current_global.diff

r=me
Attachment #8998240 - Flags: review?(bzbarsky) → review+
Pushed by opettay@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/b3a5c5824ad8
fallback to current global in FindAssociatedGlobal when nsIGlobalObject doesn't have JS object anymore, r=bz
Priority: -- → P2
https://hg.mozilla.org/mozilla-central/rev/b3a5c5824ad8
Status: NEW → RESOLVED
Closed: 6 years ago
status-firefox63: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla63
Assignee: nobody → bugs
Please request Beta approval on this when you get a chance.
status-firefox61: --- → unaffected
status-firefox62: --- → affected
status-firefox-esr52: --- → unaffected
status-firefox-esr60: --- → unaffected
Flags: needinfo?(bugs)
Comment on attachment 8998240 [details] [diff] [review]
fallback_to_current_global.diff

Approval Request Comment
[Feature/Bug causing the regression]: Old stuff
[User impact if declined]: This is basically to avoid assertion failures when running tests
[Is this code covered by automated tests?]: tests do seem to trigger this code occasionally, causing failures
[Has the fix been verified in Nightly?]: So far looking good
[Needs manual test from QE? If yes, steps to reproduce]:  NA
[List of other uplifts needed for the feature/fix]: NA
[Is the change risky?]: Shouldn't be too risky, falling back to the same global in case nsIGlobalObject is being deleted as what is used if there is no nsIGlobalObject anymore at all
[Why is the change risky/not risky?]: See above
[String changes made/needed]: NA
Flags: needinfo?(bugs)
Attachment #8998240 - Flags: approval-mozilla-beta?
Comment on attachment 8998240 [details] [diff] [review]
fallback_to_current_global.diff

Helps avoid oranges in CI. Approved for 62.0b17.
Attachment #8998240 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
ok, this is revealing some other bug. Needs to be backed out from beta.
https://bugzilla.mozilla.org/show_bug.cgi?id=1482029#c29
As requested by Smaug:

Backed out changeset a1f21507bec3 (bug 1451172) for conflicts with bug 1482029. a=backout
Depends on: 1482029
Attachment #8998240 - Flags: approval-mozilla-beta+ → approval-mozilla-beta-
The patch seem to be wrong. We start to pass around some global which apparently asserts EdgeNeedsSweepUnbarrieredSlow (bug 1482029) or so.
JSObject from global could be null because of https://searchfox.org/mozilla-central/rev/e126996d9b0a3d7653de205898517f4f5b632e7f/dom/base/nsWrapperCacheInlines.h#17

I don't yet have good ideas what to do here. Media code sure should be fixed, but that doesn't fix the generic issue of using DOM objects which belong to realm which is dying.
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: