436990 - [FIX]"ASSERTION: RefreshURIList timer callbacks should only be RefreshTimer objects" with hash change and meta-refresh

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect)

Description

[Jesse Ruderman]

Attachment: testcase (see steps to reproduce in comment 0)

Steps to reproduce:
1. Load i.html#foo (the hash part is important)
2. Wait at least one second.
3. Leave the testcase (reload, navigate to another page, or close the tab).

Result:

###!!! ASSERTION: RefreshURIList timer callbacks should only be RefreshTimer objects: 'rt', file /Users/jruderman/central/docshell/base/nsDocShell.cpp, line 4790

Comment 1

[Jesse Ruderman]

Attachment: "container" file that might be useful for use in the crashtest suite

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix

This is kind of fun.  The issue is that when a timer fires it now nulls out its callback.  But nsRefreshTimer::Notify doesn't remove the timer from the refresh list, so when we go to stop all the timers later we have a timer with a null callback and assert.

The solution is to just remove the timer when it fires, since otherwise we're sort of leaking the timer object for the lifetime of the page.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Jesse, do you think you can make a crashtest out of this?

Comment 4

[Jesse Ruderman]

Attachment: crashtest

I tested with both this directory's crashtest.list and the complete list; it triggers the assertion in both cases :)

Comment 5

[Boris Zbarsky [:bzbarsky]]

Pushed changeset 684f3d78f65a.

Comment 7

[Timothy Nikkel (:tnikkel)]

The crashtest for this bug still seems to cause some issues. See bug 566159.