1574596 - MozMill failure in debug builds on 2019-08-16: Assertion failure: IsInUncomposedDoc() || IsInShadowTree() (This will end badly!)

Status: RESOLVED FIXED

(Core :: DOM: Editor, defect, P1)

Description

[Jorg K (CEST = GMT+2)]

+++ This bug was initially created as a clone of Bug #1573639 +++

I haven't worked out which test exactly fails, but we see this:

Assertion failure: IsInUncomposedDoc() || IsInShadowTree() (This will end badly!), at /builds/worker/workspace/build/src/dom/base/nsIContentInlines.h:46
TEST-UNEXPECTED-FAIL | Disconnect Error: Application unexpectedly closed
PROCESS-CRASH | composition | application crashed [@ nsFrame::DestroyFrom(nsIFrame*, mozilla::layout::PostFrameDestroyData&)]

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Do you have a link to the try run?

That's probably a different regression, but I'm happy to take a look either way.

Comment 2

[Jorg K (CEST = GMT+2)]

Try run? ;-) - It's happening in real life:
https://treeherder.mozilla.org/#/jobs?repo=comm-central&revision=a324b7aef2aa71c42a1a664728052a3bb638e0ec&selectedJob=262063091
Z2 in Linux, Z1 on Mac/Windows.

Comment 3

[ISHIKAWA, Chiaki (back from day job exhibition event.)]

Attachment: Local failure: stacktrace with resolved symbol names.

Hi, I noticed the same issue in my local |make mozmill| test (Debian GNU/Linux AMD64) using full debug version of TB.

I have substituted the offset in the stack dump using tools/rb/fix_linux_stack.py script.

python tools/rb/fix_linux_stack.py < mylogfile

TIA

Comment 4

[ISHIKAWA, Chiaki (back from day job exhibition event.)]

(In reply to ISHIKAWA, Chiaki from comment #3)

Created attachment 9086207 [details]
Local failure: stacktrace with resolved symbol names.

Hi, I noticed the same issue in my local |make mozmill| test (Debian GNU/Linux AMD64) using full debug version of TB.

I have substituted the offset in the stack dump using tools/rb/fix_linux_stack.py script.

python tools/rb/fix_linux_stack.py < mylogfile

TIA

I notice that this is in a Destroy chain. So my educated guess is that the ordering of destroy operation has changed unless the assert has been inserted lately (?)

Comment 5

[Emilio Cobos Álvarez (:emilio)]

This is a regression from bug 1543312.

This is editor doing silly stuff like unbinding content without notifying, which of course doesn't clear the reference to the frame.

Bogus call is:

#0  0x00007f1f1393d27e in mozilla::HTMLEditor::DeleteRefToAnonymousNode(mozilla::ManualNACPtr, mozilla::PresShell*) (this=0x7f1ee77dec00, aContent=..., aPresShell=0x7f1ee8598000)
    at /home/emilio/src/moz/thunderbird/editor/libeditor/HTMLAnonymousNodeEditor.cpp:260
#1  0x00007f1f1393d036 in mozilla::HTMLEditor::RemoveListenerAndDeleteRef(nsTSubstring<char16_t> const&, nsIDOMEventListener*, bool, mozilla::ManualNACPtr, mozilla::PresShell*)
    (this=0x7f1ee77dec00, aEvent=..., aListener=0x7f1eec7c5dc0, aUseCapture=true, aElement=..., aPresShell=0x7f1ee8598000) at /home/emilio/src/moz/thunderbird/editor/libeditor/HTMLAnonymousNodeEditor.cpp:226
#2  0x00007f1f1393dbe9 in mozilla::HTMLEditor::HideResizersInternal() (this=0x7f1ee77dec00) at /home/emilio/src/moz/thunderbird/editor/libeditor/HTMLEditorObjectResizer.cpp:488
#3  0x00007f1f1393d3e2 in mozilla::HTMLEditor::HideAnonymousEditingUIs() (this=0x7f1ee77dec00) at /home/emilio/src/moz/thunderbird/editor/libeditor/HTMLAnonymousNodeEditor.cpp:272
#4  0x00007f1f1398df41 in mozilla::HTMLEditor::PreDestroy(bool) (this=0x7f1ee77dec00, aDestroyingFrames=false) at /home/emilio/src/moz/thunderbird/editor/libeditor/HTMLEditor.cpp:300
#5  0x00007f1f15bf9c23 in nsDocShellEditorData::SetHTMLEditor(mozilla::HTMLEditor*) (this=0x7f1edfa455e0, aHTMLEditor=0x0) at /home/emilio/src/moz/thunderbird/docshell/base/nsDocShellEditorData.cpp:77
#6  0x00007f1f15bf99a2 in nsDocShell::SetHTMLEditorInternal(mozilla::HTMLEditor*) (this=0x7f1ee7caa800, aHTMLEditor=0x0) at /home/emilio/src/moz/thunderbird/docshell/base/nsDocShell.cpp:11969
#7  0x00007f1f15bf98e9 in nsDocShell::SetEditor(nsIEditor*) (this=0x7f1ee7caa800, aEditor=0x0) at /home/emilio/src/moz/thunderbird/docshell/base/nsDocShell.cpp:11952
#8  0x00007f1f13a5229b in nsEditingSession::TearDownEditorOnWindow(mozIDOMWindowProxy*) (this=0x7f1ef0157310, aWindow=0x7f1ee1110f40) at /home/emilio/src/moz/thunderbird/editor/composer/nsEditingSession.cpp:518
#9  0x00007f1f106dcb88 in mozilla::dom::Document::TurnEditingOff() (this=0x7f1edfef5000) at /home/emilio/src/moz/thunderbird/dom/base/Document.cpp:5010
#10 0x00007f1f106e0a8b in mozilla::dom::Document::DeletePresShell() (this=0x7f1edfef5000) at /home/emilio/src/moz/thunderbird/dom/base/Document.cpp:6083
#11 0x00007f1f13b8e56d in mozilla::PresShell::Destroy() (this=0x7f1ee8598000) at /home/emilio/src/moz/thunderbird/layout/base/PresShell.cpp:1331
#12 0x00007f1f13c2fe89 in nsDocumentViewer::DestroyPresShell() (this=0x7f1ee75f1ac0) at /home/emilio/src/moz/thunderbird/layout/base/nsDocumentViewer.cpp:4152
#13 0x00007f1f13c2be30 in nsDocumentViewer::Hide() (this=0x7f1ee75f1ac0) at /home/emilio/src/moz/thunderbird/layout/base/nsDocumentViewer.cpp:2328
#14 0x00007f1f15bdcb68 in nsDocShell::SetVisibility(bool) (this=0x7f1ee7caa800, aVisibility=false) at /home/emilio/src/moz/thunderbird/docshell/base/nsDocShell.cpp:5476
#15 0x00007f1f108f55ea in nsFrameLoader::Hide() (this=0x7f1ee810dfc0) at /home/emilio/src/moz/thunderbird/dom/base/nsFrameLoader.cpp:1074
#16 0x00007f1f13ec5f1e in nsHideViewer::Run() (this=0x7f1ed8016330) at /home/emilio/src/moz/thunderbird/layout/generic/nsSubDocumentFrame.cpp:961
#17 0x00007f1f104f4a6d in nsContentUtils::RemoveScriptBlocker() () at /home/emilio/src/moz/thunderbird/dom/base/nsContentUtils.cpp:5179
#18 0x00007f1f0fbe4299 in nsAutoScriptBlocker::~nsAutoScriptBlocker() (this=0x7ffc1203ef18) at /home/emilio/src/moz/thunderbird/dom/base/nsContentUtils.h:3344
#19 0x00007f1f13c28c17 in nsDocumentViewer::Destroy() (this=0x7f1ee2c03560) at /home/emilio/src/moz/thunderbird/layout/base/nsDocumentViewer.cpp:1919
#20 0x00007f1f15bbc878 in nsDocShell::Destroy() (this=0x7f1ee18c4800) at /home/emilio/src/moz/thunderbird/docshell/base/nsDocShell.cpp:4926
#21 0x00007f1f15c5692f in nsXULWindow::Destroy() (this=0x7f1ee116bd60) at /home/emilio/src/moz/thunderbird/xpfe/appshell/nsXULWindow.cpp:501
#22 0x00007f1f15c42747 in nsWebShellWindow::Destroy() (this=0x7f1ee116bd60) at /home/emilio/src/moz/thunderbird/xpfe/appshell/nsWebShellWindow.cpp:733
#23 0x00007f1f15c4a7b8 in nsChromeTreeOwner::Destroy() (this=0x7f1ee7b91470) at /home/emilio/src/moz/thunderbird/xpfe/appshell/nsChromeTreeOwner.cpp:265
#24 0x00007f1f105c271f in nsGlobalWindowOuter::ReallyCloseWindow() (this=0x7f1ee11107a0) at /home/emilio/src/moz/thunderbird/dom/base/nsGlobalWindowOuter.cpp:6401
#25 0x00007f1f105d3698 in nsCloseEvent::Run() (this=0x7f1ed827a240) at /home/emilio/src/moz/thunderbird/dom/base/nsGlobalWindowOuter.cpp:6192
#26 0x00007f1f0e1bee74 in nsThread::ProcessNextEvent(bool, bool*) (this=0x7f1ef907ad30, aMayWait=true, aResult=0x7ffc1203fc38) at /home/emilio/src/moz/thunderbird/xpcom/threads/nsThread.cpp:1225
#27 0x00007f1f0e201ab6 in NS_InvokeByIndex () at /home/emilio/src/moz/thunderbird/xpcom/reflect/xptcall/md/unix/xptcinvoke_asm_x86_64_unix.S:106
#28 0x00007f1f0f726764 in CallMethodHelper::Invoke() (this=0x7ffc1203fbd8) at /home/emilio/src/moz/thunderbird/js/xpconnect/src/XPCWrappedNative.cpp:1650
#29 0x00007f1f0f71e62f in CallMethodHelper::Call() (this=0x7ffc1203fbd8) at /home/emilio/src/moz/thunderbird/js/xpconnect/src/XPCWrappedNative.cpp:1187
#30 0x00007f1f0f701779 in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) (ccx=..., mode=XPCWrappedNative::CALL_METHOD) at /home/emilio/src/moz/thunderbird/js/xpconnect/src/XPCWrappedNative.cpp:1149
#31 0x00007f1f0f703202 in XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) (cx=0x7f1ef7b1a000, argc=1, vp=0x7ffc1203ff08) at /home/emilio/src/moz/thunderbird/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:943

Since aPresShell->IsDestroying() returns true here we don't call PresShell::ContentRemoved which doesn't destroy the frame tree.

The editing UI stuff is so broken. :(

Comment 6

[Makoto Kato [:m_kato]]

https://treeherder.mozilla.org/#/jobs?repo=try&selectedJob=262239433&revision=c56384b5df792e8249c5bcf8efe79f3618e914e3

Comment 7

[Makoto Kato [:m_kato]]

Interesting is that object resizer isn't removed when editor becomes hidden even if I don't land 1543312. Also, when changing visibility, blur event isn't fired in focused element.... (filed as bug 1575160).

Comment 8

[Makoto Kato [:m_kato]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=2dcc6d749f042a75578661f64e46f07982ac6d25

Comment 9

[Makoto Kato [:m_kato]]

Attachment: Bug 1574596 - Keep editing UI until PresShell is really gone.

This is regression by bug 1543312.

By bug 1543312, we destroy editor when destroying PresShell. But when destroying PresShell, editor doesn't remove anonymous content of editing UI from PresShell. Then, when destroying the frame manager in PresShell::Destroy, it hits assertion due to uncomposed doc.

We shouldn't hide editing UI during destroying PresShell and we should hide it after destroyed.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8b40b616dbff
Keep editing UI until PresShell is really gone. r=masayuki

Comment 11

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/8b40b616dbff

Comment 12

[Jorg K (CEST = GMT+2)]

Thanks, this failure is gone now from our TB test suite.