1635885 - Fix up or remove `this == fl->GetBrowserChildMessageManager()` assertion in `InProcessBrowserChildMessageManager::GetEventTargetParent`

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[:Gijs (he/him)]

Per matrix:

<nika> A process switch from the parent process to the child process is occuring, and an event is fired inside of the in-parent frame script's context which tries to bubble out to the <browser> element. The code which does the bubbling tries to assert that it's bubbling to the correct browser element, and that assertion fails due to the process switch
<gijs> nika: if that reliably happens for events that fire during the process switch, maybe the assertion should be removed? Or fixed so it passes in that case?
<nika> Yeah, the assertion should probably be removed. Though we might want to figure out if we're doing the right thing

Example stacks:

0:10.43 GECKO(28831) [Parent 28831, Main Thread] ###!!! ASSERTION: Wrong event target!: 'this == fl->GetBrowserChildMessageManager()', file mozilla-central/dom/base/InProcessBrowserChildMessageManager.cpp, line 254
 0:20.99 GECKO(28831) #01: mozilla::EventTargetChainItem::GetEventTargetParent(mozilla::EventChainPreVisitor&) [dom/events/EventDispatcher.cpp:425]
 0:20.99 GECKO(28831) #02: mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) [dom/events/EventDispatcher.cpp:907]
 0:20.99 GECKO(28831) #03: mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) [dom/events/EventDispatcher.cpp:0]
 0:20.99 GECKO(28831) #04: mozilla::DOMEventTargetHelper::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) [dom/events/DOMEventTargetHelper.cpp:169]
 0:20.99 GECKO(28831) #05: mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&, mozilla::ErrorResult&) [dom/events/EventTarget.cpp:184]
 0:20.99 GECKO(28831) #06: mozilla::DOMEventTargetHelper::DispatchTrustedEvent(mozilla::dom::Event*) [dom/events/DOMEventTargetHelper.cpp:191]
 0:20.99 GECKO(28831) #07: mozilla::DOMEventTargetHelper::DispatchTrustedEvent(nsTSubstring<char16_t> const&) [dom/events/DOMEventTargetHelper.cpp:183]
 0:20.99 GECKO(28831) #08: mozilla::dom::InProcessBrowserChildMessageManager::FireUnloadEvent() [dom/base/InProcessBrowserChildMessageManager.cpp:215]
 0:20.99 GECKO(28831) #09: nsFrameLoader::DestroyDocShell() [dom/base/nsFrameLoader.cpp:1916]
 0:20.99 GECKO(28831) #10: nsFrameLoaderDestroyRunnable::Run() [dom/base/nsFrameLoader.cpp:1866]
 0:20.99 GECKO(28831) #11: mozilla::dom::Document::MaybeInitializeFinalizeFrameLoaders() [dom/base/Document.cpp:8539]
 0:20.99 GECKO(28831) #12: mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() [xpcom/threads/nsThreadUtils.h:1223]
 0:20.99 GECKO(28831) #13: nsContentUtils::RemoveScriptBlocker() [dom/base/nsContentUtils.cpp:5381]
 0:20.99 GECKO(28831) #14: nsFrameLoaderOwner::ChangeRemotenessCommon(nsFrameLoaderOwner::ChangeRemotenessContextType const&, bool, nsTSubstring<char16_t> const&, std::function<void ()>&, mozilla::ErrorResult&) [dom/base/nsFrameLoaderOwner.cpp:137]
 0:20.99 GECKO(28831) #15: nsFrameLoaderOwner::ChangeRemoteness(mozilla::dom::RemotenessOptions const&, mozilla::ErrorResult&) [dom/base/nsFrameLoaderOwner.cpp:200]
 0:20.99 GECKO(28831) #16: mozilla::dom::XULFrameElement_Binding::changeRemoteness(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) [s3:gecko-generated-sources-l1:20a54bb77609f2cfc4c18a09bea7d4e77c67e9158c4ad373bb89898bee8245318c713677325b7c7453a781d93548cfbdc5d6cfddb53cbdf56aaf87d3f3a88996/dom/bindings/XULFrameElementBinding.cpp::385]
 0:20.99 GECKO(28831) #17: bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) [dom/bindings/BindingUtils.cpp:3205]
 0:20.99 GECKO(28831) #18: JSObject::isCallable() const [js/src/vm/JSObject-inl.h:661]
 0:20.99 GECKO(28831) #19: Interpret(JSContext*, js::RunState&) [js/src/vm/Interpreter.cpp:4590]
 0:20.99 GECKO(28831) #20: Interpret(JSContext*, js::RunState&) [js/src/vm/Interpreter.cpp:3228]
 0:20.99 GECKO(28831) #21: js::MakeDefaultConstructor(JSContext*, JS::Handle<JSScript*>, unsigned char*, JS::Handle<JSObject*>) [js/src/vm/Interpreter.cpp:323]
 0:20.99 GECKO(28831) #22: Interpret(JSContext*, js::RunState&) [js/src/vm/Interpreter.cpp:0]
 0:20.99 GECKO(28831) #23: js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) [js/src/jit/BaselineIC.cpp:2910]
 0:20.99 GECKO(28831) #24: ??? (???:???)
 0:20.99 GECKO(28831) [Parent 28831, Main Thread] ###!!! ASSERTION: Wrong message manager!: 'fl->mMessageManager == mChromeMessageManager', file mozilla-central/dom/base/InProcessBrowserChildMessageManager.cpp, line 256
 0:20.99 GECKO(28831) #01: mozilla::EventTargetChainItem::GetEventTargetParent(mozilla::EventChainPreVisitor&) [dom/events/EventDispatcher.cpp:425]
 0:20.99 GECKO(28831) #02: mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) [dom/events/EventDispatcher.cpp:907]
 0:20.99 GECKO(28831) #03: mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) [dom/events/EventDispatcher.cpp:0]
 0:20.99 GECKO(28831) #04: mozilla::DOMEventTargetHelper::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) [dom/events/DOMEventTargetHelper.cpp:169]
 0:20.99 GECKO(28831) #05: mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&, mozilla::ErrorResult&) [dom/events/EventTarget.cpp:184]
 0:20.99 GECKO(28831) #06: mozilla::DOMEventTargetHelper::DispatchTrustedEvent(mozilla::dom::Event*) [dom/events/DOMEventTargetHelper.cpp:191]
 0:20.99 GECKO(28831) #07: mozilla::DOMEventTargetHelper::DispatchTrustedEvent(nsTSubstring<char16_t> const&) [dom/events/DOMEventTargetHelper.cpp:183]
 0:20.99 GECKO(28831) #08: mozilla::dom::InProcessBrowserChildMessageManager::FireUnloadEvent() [dom/base/InProcessBrowserChildMessageManager.cpp:215]
 0:20.99 GECKO(28831) #09: nsFrameLoader::DestroyDocShell() [dom/base/nsFrameLoader.cpp:1916]
 0:20.99 GECKO(28831) #10: nsFrameLoaderDestroyRunnable::Run() [dom/base/nsFrameLoader.cpp:1866]
 0:20.99 GECKO(28831) #11: mozilla::dom::Document::MaybeInitializeFinalizeFrameLoaders() [dom/base/Document.cpp:8539]
 0:21.00 GECKO(28831) #12: mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() [xpcom/threads/nsThreadUtils.h:1223]
 0:21.00 GECKO(28831) #13: nsContentUtils::RemoveScriptBlocker() [dom/base/nsContentUtils.cpp:5381]
 0:21.00 GECKO(28831) #14: nsFrameLoaderOwner::ChangeRemotenessCommon(nsFrameLoaderOwner::ChangeRemotenessContextType const&, bool, nsTSubstring<char16_t> const&, std::function<void ()>&, mozilla::ErrorResult&) [dom/base/nsFrameLoaderOwner.cpp:137]
 0:21.00 GECKO(28831) #15: nsFrameLoaderOwner::ChangeRemoteness(mozilla::dom::RemotenessOptions const&, mozilla::ErrorResult&) [dom/base/nsFrameLoaderOwner.cpp:200]
 0:21.00 GECKO(28831) #16: mozilla::dom::XULFrameElement_Binding::changeRemoteness(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) [s3:gecko-generated-sources-l1:20a54bb77609f2cfc4c18a09bea7d4e77c67e9158c4ad373bb89898bee8245318c713677325b7c7453a781d93548cfbdc5d6cfddb53cbdf56aaf87d3f3a88996/dom/bindings/XULFrameElementBinding.cpp::385]
 0:21.00 GECKO(28831) #17: bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) [dom/bindings/BindingUtils.cpp:3205]
 0:21.00 GECKO(28831) #18: JSObject::isCallable() const [js/src/vm/JSObject-inl.h:661]
 0:21.00 GECKO(28831) #19: Interpret(JSContext*, js::RunState&) [js/src/vm/Interpreter.cpp:4590]
 0:21.00 GECKO(28831) #20: Interpret(JSContext*, js::RunState&) [js/src/vm/Interpreter.cpp:3228]
 0:21.00 GECKO(28831) #21: js::MakeDefaultConstructor(JSContext*, JS::Handle<JSScript*>, unsigned char*, JS::Handle<JSObject*>) [js/src/vm/Interpreter.cpp:323]
 0:21.00 GECKO(28831) #22: Interpret(JSContext*, js::RunState&) [js/src/vm/Interpreter.cpp:0]
 0:21.00 GECKO(28831) #23: js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) [js/src/jit/BaselineIC.cpp:2910]
 0:21.00 GECKO(28831) #24: ??? (???:???)

Comment 1

[Beth Rennie [:beth] (she/her)]

Attachment: Bug 1635885 - Remove debug assertions that fail during process switch r?nika

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9273d7dd8001
Remove debug assertions that fail during process switch r=kmag

Comment 3

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/9273d7dd8001