Messages in hidden tabs break adoptNode wrapper forever

RESOLVED FIXED

Status

defect
--
critical
RESOLVED FIXED
12 years ago
12 years ago

People

(Reporter: bugzilla-mozilla-20000923, Assigned: bugzilla-mozilla-20000923)

Tracking

({regression})

Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [cz-0.9.81])

Attachments

(1 attachment)

Assignee

Description

12 years ago
Summary of what I believe happens (not entirely verified yet):
- Hide a tab, which removes the <browser> and does removeChild on the
  messages (<table>) to detach it from the document.
- Some time later (possibly not very long) the GC knocks, and recycles the
  document object. This causes ownerDocument on messages and all its children
  to become null (violation of the DOM spec).
- Next message for a hidden tab arrives, attempts to adopt into
  messages.ownerDocument, but it is null and this causes an error.
- The error trips the code into making adoptNode a no-op.

We might be able to work around the bad DOM implementation by just not calling removeChild in cmdHideView, if this is enough to force Gecko into keeping the document around. Alternatively, we can try and force the new view into existence *before* adding the newly-arrived message.
Assignee

Comment 1

12 years ago
I have just verified with my debug build that if no GC occurs between hiding and a message arriving, it is fine; if a GC does occur, it breaks.

Updated

12 years ago
Depends on: 413127

Updated

12 years ago
Depends on: strongparent

Updated

12 years ago
No longer depends on: 413127
Assignee

Comment 2

12 years ago
This adopts the messages into a hidden document which we forever keep a reference to (until we close), which means the nodes are no longer at risk of having null ownerDocuments.
Assignee: rginda → silver
Status: NEW → ASSIGNED
Attachment #298106 - Flags: review?(gijskruitbosch+bugs)

Comment 3

12 years ago
Comment on attachment 298106 [details] [diff] [review]
Avoid null ownerDocument by adopting into controlled hidden document

Don't you need to null client.hiddenDocument out at some point? (onUnload?)

With that, or an explanation, r=gijs
Attachment #298106 - Flags: review?(gijskruitbosch+bugs) → review+
Assignee

Comment 4

12 years ago
Checked in --> FIXED.
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Assignee

Updated

12 years ago
Whiteboard: [cz-0.9.81]
You need to log in before you can comment on or make changes to this bug.