435779 - Crash [@ PostMessageEvent::Run()]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Olli Pettay [:smaug][[e-mail]]]

While running mochitest, I got the following crash:
0x00000032d900d97f in waitpid () from /lib64/libpthread.so.0
#0  0x00000032d900d97f in waitpid () from /lib64/libpthread.so.0
#1  0x00000032e8a57c97 in ?? () from /usr/lib64/libgnomeui-2.so.0
#2  0x00002aaaaaaf538a in nsProfileLock::FatalSignalHandler (signo=11) at nsProfileLock.cpp:216
#3  <signal handler called>
#4  PostMessageEvent::Run (this=0x84610b0) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/dom/src/base/nsGlobalWindow.cpp:5239
#5  0x00002aaaab271209 in nsThread::ProcessNextEvent (this=0x66c510, mayWait=1, result=0x7fffe85b7fec)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/xpcom/threads/nsThread.cpp:510
#6  0x00002aaaab22efb7 in NS_ProcessNextEvent_P (thread=0x32d734b840, mayWait=1) at nsThreadUtils.cpp:227
#7  0x00002aaab98361da in nsBaseAppShell::Run (this=0xcc64d0)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:170
#8  0x00002aaab707b24d in nsAppStartup::Run (this=0xc8f240)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:181
#9  0x00002aaaaaae9f43 in XRE_main (argc=<value optimized out>, argv=<value optimized out>, aAppData=<value optimized out>)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/toolkit/xre/nsAppRunner.cpp:3170
#10 0x0000000000400eba in main (argc=5, argv=0x0)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/browser/app/nsBrowserApp.cpp:158

Seems like targetWindow is null - and that is possible for example after closing
a window.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Attachment: null check

Comment 2

[Brendan Eich [:brendan]]

Safe fix to ride along into RC2?

/be

Comment 3

[Mike Shaver (:shaver emeritus)]

3.0.1 will enjoy this patch tremendously, especially if we have a test that actually exercises this deterministically.

Comment 4

[Jeff Walden [:Waldo]]

Maybe we just need a Cu.forceGC() in test_postMessage_closed.html somewhere to trigger it deterministically?

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Checḱed in to hg.

Comment 6

[Samuel Sidler (old account; do not CC)]

Did this land in CVS yet? If not, should it per comment 3? Please request approval on the patch if so.

Comment 7

[Daniel Veditz [:dveditz]]

not a top crash, only 17 crashes and the 100th top crash has 276 in the current stats window. Is this worth the risk given we don't have a test for it?

Comment 8

[Mike Connor [:mconnor]]

Comment on attachment 322553 [details] [diff] [review]
null check

Would probably approve if this had tests, but not going to take without it, given that its quite rare, per dveditz.

Comment 9

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 322553 [details] [diff] [review]
null check

For some reason this is now quite high up in the 3.0.6 topcrashers.

Comment 10

[Samuel Sidler (old account; do not CC)]

Hm, yeah. Strangely this is the number 2 topcrash for Firefox 3.0.6. We should probably block on this too.

Comment 11

[Daniel Veditz [:dveditz]]

Comment on attachment 322553 [details] [diff] [review]
null check

Approved for 1.9.0.8, a=dveditz for release-drivers