266075 - Assertion failure: !fp->script && (!fp->fun || fp->fun->native), at c:/mozilla/js/src/jsopcode.c:2544

Status: RESOLVED INCOMPLETE

(Core :: XPConnect, defect, P5)

Description

[timeless]

###!!! ASSERTION:
XPConnect is being called on a scope without a 'Components' property!

This is pretty much always bad. It usually means that native code is
making a callback to an interface implemented in JavaScript, but the
document where the JS object was created has already been cleared and the
global properties of that document's window are *gone*. Generally this
indicates a problem that should be addressed in the design and use of the
callback code.
: 'Error', file c:/mozilla/js/src/xpconnect/src/xpcwrappednativescope.cpp, 
line 554
************************************************************
* Call to xpconnect wrapped JSObject produced this error:  *
[Exception... "'[JavaScript Error: "Object is not defined" 
{file: "chrome://venkman/content/venkman-debugger.js" line: 189}]' when 
calling method: [jsdIScriptHook::onScriptCreated]"  nsresult: "0x80570021 
(NS_ERROR_XPC_JAVASCRIPT_ERROR_WITH_DETAILS)"  location: "JS frame :: 
chrome://global/content/globalOverlay.js :: goQuitApplication :: line 37"  
data: yes]
************************************************************
###!!! ASSERTION:
XPConnect is being called on a scope without a 'Components' property!

This is pretty much always bad. It usually means that native code is
making a callback to an interface implemented in JavaScript, but the
document where the JS object was created has already been cleared and the
global properties of that document's window are *gone*. Generally this
indicates a problem that should be addressed in the design and use of the
callback code.
: 'Error', file c:/mozilla/js/src/xpconnect/src/xpcwrappednativescope.cpp, 
line 554
###!!! ASSERTION:
XPConnect is being called on a scope without a 'Components' property!

This is pretty much always bad. It usually means that native code is
making a callback to an interface implemented in JavaScript, but the
document where the JS object was created has already been cleared and the
global properties of that document's window are *gone*. Generally this
indicates a problem that should be addressed in the design and use of the
callback code.
: 'Error', file c:/mozilla/js/src/xpconnect/src/xpcwrappednativescope.cpp, 
line 554
************************************************************
* Call to xpconnect wrapped JSObject produced this error:  *
[Exception... "'[JavaScript Error: "dd is not defined" 
{file: "chrome://venkman/content/venkman-debugger.js" line: 245}]' when 
calling method: [jsdIExecutionHook::onExecute]"  nsresult: "0x80570021 
(NS_ERROR_XPC_JAVASCRIPT_ERROR_WITH_DETAILS)"  location: "JS frame :: 
chrome://navigator/content/navigator.js :: Shutdown
:: line 736"  data: yes]
************************************************************
###!!! ASSERTION:
XPConnect is being called on a scope without a 'Components' property!

This is pretty much always bad. It usually means that native code is
making a callback to an interface implemented in JavaScript, but the
document where the JS object was created has already been cleared and the
global properties of that document's window are *gone*. Generally this
indicates a problem that should be addressed in the design and use of the
callback code.
: 'Error', file c:/mozilla/js/src/xpconnect/src/xpcwrappednativescope.cpp, 
line 554
************************************************************
* Call to xpconnect wrapped JSObject produced this error:  *
[Exception... "'[JavaScript Error: "console is not defined" 
{file: "chrome://venkman/content/venkman-debugger.js" line: 379}]' when 
calling method: [jsdIErrorHook::onError]"  nsresult: "0x80570021 
(NS_ERROR_XPC_JAVASCRIPT_ERROR_WITH_DETAILS)"  location: "<unknown>"  data: 
yes]
************************************************************
JavaScript error:
 line 0: uncaught exception: [Exception... "Component returned failure code: 
0x80004005 (NS_ERROR_FAILURE) [nsIControllers.removeController]"  
nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: 
chrome://navigator/content/navigator.js :: Shutdown :: line 736"  data: no]

--WEBSHELL == 13
###!!! ASSERTION: expected a XUL document: 'xuldoc', file 
c:/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp, line 1468
###!!! ASSERTION: expected a XUL document: 'xuldoc', file 
c:/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp, line 1468
###!!! ASSERTION: expected a XUL document: 'xuldoc', file 
c:/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp, line 1468
###!!! ASSERTION: expected a XUL document: 'xuldoc', file 
c:/mozilla/content/xul/templates/src/nsXULContentBuilder.cpp, line 1468
blorf!!!        WARNING: getting z level of unregistered window, file 
c:/mozilla/xpfe/appshell/src/nsWindowMediator.cpp, line 636
WARNING: getting z level of unregistered window, file 
c:/mozilla/xpfe/appshell/src/nsWindowMediator.cpp, line 636
###!!! ASSERTION:
XPConnect is being called on a scope without a 'Components' property!

This is pretty much always bad. It usually means that native code is
making a callback to an interface implemented in JavaScript, but the
document where the JS object was created has already been cleared and the
global properties of that document's window are *gone*. Generally this
indicates a problem that should be addressed in the design and use of the
callback code.
: 'Error', file c:/mozilla/js/src/xpconnect/src/xpcwrappednativescope.cpp, 
line 554
Assertion failure: !fp->script && (!fp->fun || fp->fun->native), at 
c:/mozilla/js/src/jsopcode.c:2544

 	ntdll.dll!77f75a58() 	
 	js3250.dll!JS_Assert(s=0x00c75104, file=0x00c750dc, ln=2544)  Line 155
	C
>	js3250.dll!js_DecompileValueGenerator(cx=0x00a7aa18, spindex=1, 
v=88823656, fallback=0x00a23878)  Line 2544 + 0x34	C
 	js3250.dll!js_DefaultValue(cx=0x00a7aa18, obj=0x054b5768, 
hint=JSTYPE_STRING, vp=0x0012d0d4)  Line 3087 + 0x13	C
 	js3250.dll!js_ValueToString(cx=0x00a7aa18, v=88823656)  Line 2655 + 
0x19	C
 	js3250.dll!JS_ValueToString(cx=0x00a7aa18, v=88823656)  Line 529 + 0xd
	C
 	xpc3250.dll!XPCConvert::JSValToXPCException(ccx={...}, s=88823656, 
ifaceName=0x03041588, methodName=0x03ea9ab8, exceptn=0x0012d35c)  Line 1242 + 
0xe	C++
 	xpc3250.dll!nsXPCWrappedJSClass::CheckForException(ccx={...}, 
aPropertyName=0x03ea9ab8, anInterfaceName=0x03041588)  Line 826 + 0x30	C++
 	xpc3250.dll!nsXPCWrappedJSClass::CallMethod(wrapper=0x043004c8, 
methodIndex=3, info=0x03ea9a98, nativeParams=0x0012d674)  Line 1373 + 0x1c
	C++
 	xpc3250.dll!nsXPCWrappedJS::CallMethod(methodIndex=3, info=0x03ea9a98, 
params=0x0012d674)  Line 450	C++
 	xpcom.dll!PrepareAndDispatch(self=0x043004c8, methodIndex=3, 
args=0x0012d73c, stackBytesToPop=0x0012d72c)  Line 117 + 0x1c	C++
 	xpcom.dll!SharedStub()  Line 147	C++
 	jsd3250.dll!jsds_ScriptHookProc(jsdc=0x00aab028, jsdscript=0x02c7a7b0, 
creating=1, callerdata=0x00000000)  Line 723	C++
 	jsd3250.dll!jsd_NewScriptHookProc(cx=0x00a7aa18, filename=0x034d9825, 
lineno=361, script=0x051ed718, fun=0x02c8cf50, callerdata=0x00aab028)  Line 
562 + 0x11	C
 	js3250.dll!js_CallNewScriptHook(cx=0x00a7aa18, script=0x051ed718, 
fun=0x02c8cf50)  Line 1143 + 0x27	C
 	js3250.dll!js_NewScriptFromCG(cx=0x00a7aa18, cg=0x0012d85c, 
fun=0x02c8cf50)  Line 1110 + 0x11	C
 	js3250.dll!js_CompileFunctionBody(cx=0x00a7aa18, ts=0x05317de0, 
fun=0x02c8cf50)  Line 694 + 0x14	C
 	js3250.dll!JS_CompileUCFunctionForPrincipals(cx=0x00a7aa18, 
obj=0x031a8390, principals=0x00a9214c, name=0x0359d72c, nargs=1, 
argnames=0x01f01480, chars=0x034e85e0, length=141, filename=0x034cb528, 
lineno=361)  Line 3345 + 0x11	C
 	gklayout.dll!nsJSContext::CompileEventHandler(aTarget=0x031a8390, 
aName=0x0359d720, aBody={...}, aURL=0x034cb528, aLineNo=361, aShared=1, 
aHandler=0x0012e058)  Line 1192 + 0x4a	C++
 	gklayout.dll!nsXBLPrototypeHandler::ExecuteHandler
(aReceiver=0x03164258, aEvent=0x02414c80)  Line 441	C++
 	gklayout.dll!nsXBLPrototypeHandler::BindingDetached
(aReceiver=0x03164258)  Line 533	C++
 	gklayout.dll!nsXBLPrototypeBinding::BindingDetached
(aReceiver=0x03164258)  Line 383 + 0x12	C++
 	gklayout.dll!nsXBLBinding::ExecuteDetachedHandler()  Line 863	C++
 	gklayout.dll!ExecuteDetachedHandler(aTable=0x028ff8ac, 
aHdr=0x03e34bd8, aNumber=11, aClosure=0x00000000)  Line 956	C++
 	xpcom.dll!PL_DHashTableEnumerate(table=0x028ff8ac, etor=0x01af1f60, 
arg=0x00000000)  Line 619 + 0x19	C
 	gklayout.dll!nsBindingManager::ExecuteDetachedHandlers()  Line 965 + 
0x13	C++
 	gklayout.dll!GlobalWindowImpl::HandleDOMEvent(aPresContext=0x02bb2b70, 
aEvent=0x0012e314, aDOMEvent=0x0012e2e4, aFlags=7, aEventStatus=0x0012e310)  
Line 862	C++
 	gklayout.dll!DocumentViewerImpl::Unload()  Line 1094	C++
 	docshell.dll!nsDocShell::FireUnloadNotification()  Line 826	C++
 	docshell.dll!nsDocShell::Destroy()  Line 3033	C++
 	docshell.dll!nsWebShell::Destroy()  Line 1230	C++
 	appshell.dll!nsXULWindow::Destroy()  Line 491	C++
 	appshell.dll!nsWebShellWindow::Destroy()  Line 1663 + 0x9	C++
 	appshell.dll!nsChromeTreeOwner::Destroy()  Line 330	C++
 	gklayout.dll!GlobalWindowImpl::ReallyCloseWindow()  Line 3694	C++
 	gklayout.dll!GlobalWindowImpl::CloseWindow(aWindow=0x02946474)  Line 
4819	C++
 	gklayout.dll!nsJSContext::ScriptEvaluated(aTerminated=1)  Line 1753 + 
0x12	C++
 	gklayout.dll!nsJSContext::CallEventHandler(aTarget=0x04998e08, 
aHandler=0x04998e18, argc=1, argv=0x0012e71c, rval=0x0012e724)  Line 1301
	C++
 	gklayout.dll!nsJSEventListener::HandleEvent(aEvent=0x04f9e600)  Line 
175 + 0x2b	C++
 	gklayout.dll!nsXBLPrototypeHandler::ExecuteHandler
(aReceiver=0x04864cb0, aEvent=0x04f9e600)  Line 461	C++
 	gklayout.dll!nsXBLWindowHandler::WalkHandlersInternal
(aEvent=0x04f9e600, aEventType=0x00a14d08, aHandler=0x032d70e0)  Line 320 + 
0x18	C++
 	gklayout.dll!nsXBLWindowKeyHandler::WalkHandlers(aKeyEvent=0x04f9e600, 
aEventType=0x00a14d08)  Line 162	C++
 	gklayout.dll!nsXBLWindowKeyHandler::KeyPress(aKeyEvent=0x04f9e600)  
Line 178	C++
 	gklayout.dll!DispatchToInterface(aEvent=0x04f9e600, 
aListener=0x02b816d0, aMethod=0x01a40420, aIID={...}, 
aHasInterface=0x0012ef78)  Line 127 + 0xb	C++
 	gklayout.dll!nsEventListenerManager::HandleEvent
(aPresContext=0x02bb2b70, aEvent=0x0012f764, aDOMEvent=0x0012f424, 
aCurrentTarget=0x0247e1d0, aFlags=514, aEventStatus=0x0012f598)  Line 1520 + 
0x23	C++
 	gklayout.dll!nsXULDocument::HandleDOMEvent(aPresContext=0x02bb2b70, 
aEvent=0x0012f764, aDOMEvent=0x0012f424, aFlags=514, aEventStatus=0x0012f598)  
Line 1249	C++
 	gklayout.dll!nsXULElement::HandleDOMEvent(aPresContext=0x02bb2b70, 
aEvent=0x0012f764, aDOMEvent=0x0012f424, aFlags=519, aEventStatus=0x0012f598)  
Line 2875 + 0x36	C++
 	gklayout.dll!PresShell::HandleEventInternal(aEvent=0x0012f764, 
aView=0x02bb0388, aFlags=1, aStatus=0x0012f598)  Line 6048 + 0x31	C++
 	gklayout.dll!PresShell::HandleEvent(aView=0x02bb0388, 
aEvent=0x0012f764, aEventStatus=0x0012f598, aForceHandle=1, aHandled=1)  Line 
5916 + 0x19	C++
 	gklayout.dll!nsViewManager::HandleEvent(aView=0x02bb0388, 
aEvent=0x0012f764, aCaptured=0)  Line 2239	C++
 	gklayout.dll!nsViewManager::DispatchEvent(aEvent=0x0012f764, 
aStatus=0x0012f6c0)  Line 2025 + 0x14	C++
 	gklayout.dll!HandleEvent(aEvent=0x0012f764)  Line 79	C++
 	gkwidget.dll!nsWindow::DispatchEvent(event=0x0012f764, 
aStatus=nsEventStatus_eIgnore)  Line 1067 + 0xa	C++
 	gkwidget.dll!nsWindow::DispatchWindowEvent(event=0x0012f764)  Line 1088
	C++
 	gkwidget.dll!nsWindow::DispatchKeyEvent(aEventType=131, aCharCode=113, 
aVirtualCharCode=0, aKeyData=0)  Line 2978 + 0xf	C++
 	gkwidget.dll!nsWindow::OnChar(mbcsCharCode=17, virtualKeyCode=0, 
isMultiByte=false)  Line 3165	C++
 	gkwidget.dll!nsWindow::ProcessMessage(msg=258, wParam=17, 
lParam=1048577, aRetValue=0x0012fbf8)  Line 3880 + 0x22	C++
 	gkwidget.dll!nsWindow::WindowProc(hWnd=0x00e20230, msg=258, wParam=17, 
lParam=1048577)  Line 1349 + 0x1b	C++
 	user32.dll!77d43a50() 	
 	user32.dll!77d43b1f() 	
 	user32.dll!77d43d79() 	
 	ntdll.dll!77f944a8() 	
 	xpcom.dll!nsAutoLock::~nsAutoLock()  Line 189 + 0x8	C++
 	user32.dll!77d43ddf() 	
 	gkwidget.dll!nsAppShell::Run()  Line 135	C++
 	appshell.dll!nsAppShellService::Run()  Line 524	C++
 	mozilla.exe!main1(argc=1, argv=0x002a54e0, nativeApp=0x00a3e888)  Line 
1303 + 0x20	C++
 	mozilla.exe!main(argc=1, argv=0x002a54e0)  Line 1791 + 0x25	C++
 	mozilla.exe!mainCRTStartup()  Line 398 + 0x11	C
 	kernel32.dll!77e814c7() 	
 	ntdll.dll!77f944a8() 	

-	fp	0x0012d7ac {callobj=0x00000000 {map=??? slots=??? } 
argsobj=0x00000000 {map=??? slots=??? } varobj=0x00000000 {map=??? 
slots=??? } ...}	JSStackFrame *
|+	callobj	0x00000000 {map=??? slots=??? }	JSObject *
|+	argsobj	0x00000000 {map=??? slots=??? }	JSObject *
|+	varobj	0x00000000 {map=??? slots=??? }	JSObject *
|-	script	0x051ed718 {code=0x051ed748 "A5" length=25 
main=0x051ed748 "A5" ...}	JSScript *
|+	code	0x051ed748 "A5"	unsigned char *
||	length	25	unsigned long
||+	main	0x051ed748 "A5"	unsigned char *
||	version	JSVERSION_DEFAULT	JSVersion
||+	atomMap	{vector=0x02586428 length=3 }	JSAtomMap
||+	filename
	0x034d9825 "chrome://global/content/bindings/browser.xml"	const 
char *
||	lineno	361	unsigned int
||	depth	2	unsigned int
||+	trynotes	0x00000000 {start=??? length=??? catchStart=??? }
	JSTryNote *
||+	principals	0x00a9214c {codebase=0x00a92198 "[System Principal]" 
getPrincipalArray=0x00c97860 globalPrivilegesEnabled=0x00c97870 ...}
	JSPrincipals *
|\+	object	0x00000000 {map=??? slots=??? }	JSObject *
|+	fun	0x00000000 {nrefs=??? object=??? native=??? ...}
	JSFunction *
|+	thisp	0x00000000 {map=??? slots=??? }	JSObject *
|	argc	0	unsigned int
|+	argv	0x00000000	long *
|	rval	0	long
|	nvars	0	unsigned int
|+	vars	0x00000000	long *
|+	down	0x0012d92c {callobj=0x00000000 {map=??? slots=??? } 
argsobj=0x00000000 {map=??? slots=??? } varobj=0x054b56f0 {map=0x04c41fb8 
{nrefs=1 ops=0x00c6db28 _js_ObjectOps nslots=5 ...} slots=0x0251d984 } ...}
	JSStackFrame *
|	annotation	0x00000000	void *
|+	scopeChain	0x00000000 {map=??? slots=??? }	JSObject *
|+	pc	0x00000000 <Bad Ptr>	unsigned char *
|+	sp	0x00000000	long *
|+	spbase	0x00000000	long *
|	sharpDepth	0	unsigned int
|+	sharpArray	0x00000000 {map=??? slots=??? }	JSObject *
|	flags	0	unsigned long
|+	dormantNext	0x00000000 {callobj=??? argsobj=??? varobj=??? ...}
	JSStackFrame *
\+	objAtomMap	0x00000000 {vector=??? length=??? }	JSAtomMap *

@ 	xpc3250.dll!XPCConvert::JSValToXPCException(ccx={...}, s=88823656, 
ifaceName=0x03041588, methodName=0x03ea9ab8, exceptn=0x0012d35c)  Line 1242 + 
0xe	C++
-	report	0x03b0dc98 
{filename=0x0498a520 "chrome://venkman/content/venkman-debugger.js" lineno=189 
linebuf=0x00000000 <Bad Ptr> ...}	const JSErrorReport *
+	filename	0x0498a520 "chrome://venkman/content/venkman-
debugger.js"	const char *
	lineno	189	unsigned int
+	linebuf	0x00000000 <Bad Ptr>	const char *
+	tokenptr	0x00000000 <Bad Ptr>	const char *
+	uclinebuf	0x00000000 <Bad Ptr>	const unsigned short *
+	uctokenptr	0x00000000 <Bad Ptr>	const unsigned short *
	flags	0	unsigned int
	errorNumber	1	unsigned int
+	ucmessage	0x04d511e8 "Object is not defined"	const unsigned 
short *
+	messageArgs	0x0259e348	const unsigned short * *

@ 	js3250.dll!JS_CompileUCFunctionForPrincipals(cx=0x00a7aa18, 
obj=0x031a8390, principals=0x00a9214c, name=0x0359d72c, nargs=1, 
argnames=0x01f01480, chars=0x034e85e0, length=141, filename=0x034cb528, 
lineno=361)  Line 3345 + 0x11	C
+ chars 0x034e85e0 "
        
          if (this.mDragDropHandler)
            this.mDragDropHandler.detach();
          this.securityUI = null;
        
      "	const unsigned short *
	length	141	unsigned int
+	filename
	0x034cb528 "chrome://global/content/bindings/browser.xml"	const 
char *
	lineno	361	unsigned int

@	xpc3250.dll!nsXPCWrappedJSClass::CallMethod(wrapper=0x043004c8, 
methodIndex=3, info=0x03ea9a98, nativeParams=0x0012d674)  Line 1373 + 0x1c
	C++
+	name	0x03ea9ab8 "onScriptCreated"	const char *

<timeless> (this case is basically catastrophic teardown, everything that 
could go wrong did go wrong)

<dbradley> So a script was being created on shutdown
<timeless> specifically a destructor
<timeless> dbradley: is it reasonable to assert that nsXPCWJSC::CallMethod 
took the !JSVAL_IS_PRIMITIVE(fval) branch
<timeless> thus the exception it's trying to report would come from:
<timeless>             success = js_Invoke(cx, argc, JSINVOKE_INTERNAL);
<dbradley> timeless: But that sounds reasonable
<timeless> dbradley: ok
<timeless> suppose i decide to blame xpconnect
<timeless> instead of venkman
<timeless> specifically callmethod
<timeless> is checkforexception presuming that the cx-<timeless>fp is still 
related to the one that was running when the code failed?
<timeless> if so, the code doesn't work
<dbradley> timeless: I think the question is, is this exception valid? Can you 
tell why the exception is being thrown?
<timeless> since callmethod has already reset cx-<timeless>fp
<dbradley> timeless: Possibly, I'd havve to look at the code
<timeless> the cx-<timeless>fp stuff is browser.xml
<timeless> which isn't the right stack
<timeless> the exception is venkman
<timeless> which would be the exception that callmethod generated in that if 
block
<timeless> so i think the problem is that checkexception is called too late
<dbradley> timeless: Ok, well that sounds like a reasonable description, 
exception handling logic using the wrong frame pointer
<timeless> and therefore spidermonkey is ****

<dbradley> timeless: Can you reproduce this?
<timeless> dbradley: hrm
<timeless> i don't want to lose what i have
<timeless> i think i frequently crash while quiting while venkman is debugging 
stuff
<timeless> but not always
<timeless> i also rarely do this
<timeless> i mean, i'm evil, but not that consistently evil
* dbradley laughs
<dbradley> timeless: Well it's worth a review of that logic

Comment 1

[Ryan VanderMeulen [:RyanVM]]

8+ years without any activity and an assertion that no longer exists doesn't sound like the makings of an actionable bug.