466326 - #!!! ASSERTION: killing mutation events: 'nsContentUtils::IsSafeToRunScript()

Status: RESOLVED FIXED

(Core :: XUL, defect)

Description

[Olli Pettay [:smaug][[e-mail]]]

Attachment: Use a script runner to unset attribute

The patch removes all the "killing mutation events" assertions which occur when
running chrome/browser-chrome/mochitest. The stack doesn't look similar to bug 433376.

Neil, do you think the patch could cause some problems? Do we *always* have to unset the attribute synchronously, even in this case when we're destroying
frames. The patch postpones unsetting if there are script blockers.


0   libSystem.B.dylib             	0x949e2e32 __kill + 10
1   libSystem.B.dylib             	0x94a552a6 raise + 26
2   libSystem.B.dylib             	0x94a616c5 abort + 73
3   libgklayout.dylib             	0x11d594b1 nsXULElement::UnsetAttr(int, nsIAtom*, int) + 3409 (nsContentUtils.h:1528)
4   libgklayout.dylib             	0x1181c89c nsMenuFrame::PopupClosed(int) + 92 (nsMenuFrame.cpp:590)
5   libgklayout.dylib             	0x11817946 nsMenuPopupFrame::HidePopup(int, nsPopupState) + 582 (nsMenuPopupFrame.cpp:682)
6   libgklayout.dylib             	0x118310ff nsXULPopupManager::HidePopupsInList(nsTArray<nsMenuPopupFrame*> const&, int) + 175 (nsXULPopupManager.cpp:849)
7   libgklayout.dylib             	0x11833bda nsXULPopupManager::PopupDestroyed(nsMenuPopupFrame*) + 458 (nsTArray.h:66)
8   libgklayout.dylib             	0x118158ef nsMenuPopupFrame::Destroy() + 31 (nsMenuPopupFrame.cpp:1701)
9   libgklayout.dylib             	0x1181cc32 nsMenuFrame::Destroy() + 146 (nsMenuFrame.cpp:408)
10  libgklayout.dylib             	0x117ede88 nsBoxFrame::RemoveFrame(nsIAtom*, nsIFrame*) + 184 (nsBoxFrame.cpp:1021)
11  libgklayout.dylib             	0x115a508f nsFrameManager::RemoveFrame(nsIFrame*, nsIAtom*, nsIFrame*) + 127 (nsFrameManager.cpp:709)
12  libgklayout.dylib             	0x115691a9 nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, int, int*) + 2249 (nsCSSFrameConstructor.cpp:9478)
13  libgklayout.dylib             	0x115cb4a9 PresShell::ContentRemoved(nsIDocument*, nsIContent*, nsIContent*, int) + 217 (nsPresShell.cpp:4760)
14  libgklayout.dylib             	0x11905b32 nsNodeUtils::ContentRemoved(nsINode*, nsIContent*, int) + 562 (nsTObserverArray.h:304)
15  libgklayout.dylib             	0x118e8836 nsGenericElement::doRemoveChildAt(unsigned int, int, nsIContent*, nsIContent*, nsIDocument*, nsAttrAndChildArray&) + 1622 (nsGenericElement.cpp:3364)
16  libgklayout.dylib             	0x118e8f8f nsGenericElement::RemoveChildAt(unsigned int, int) + 335 (nsGenericElement.cpp:3294)
17  libgklayout.dylib             	0x11d50114 nsXULElement::RemoveChildAt(unsigned int, int) + 308 (nsXULElement.cpp:959)
18  libgklayout.dylib             	0x118d78b1 nsGenericElement::doRemoveChild(nsIDOMNode*, nsIContent*, nsIDocument*, nsIDOMNode**) + 257 (nsGenericElement.cpp:3962)
19  libgklayout.dylib             	0x118d79f7 nsGenericElement::RemoveChild(nsIDOMNode*, nsIDOMNode**) + 71 (nsGenericElement.cpp:3527)
20  libxpconnect.dylib            	0x13b187ab nsIDOMNode_RemoveChild(JSContext*, unsigned int, long*) + 523 (dom_quickstubs.cpp:2757)
21  libmozjs.dylib                	0x00205c0d js_Interpret + 112909 (jsinterp.cpp:5127)
22  libmozjs.dylib                	0x002177af js_Invoke + 2467 (jsinterp.cpp:1331)
23  libmozjs.dylib                	0x002179d1 js_InternalInvoke + 119 (jsinterp.cpp:1389)
24  libmozjs.dylib                	0x001ab67e JS_CallFunctionValue + 134 (jsapi.cpp:5242)
25  libgklayout.dylib             	0x11ba98ee nsJSContext::CallEventHandler(nsISupports*, void*, void*, nsIArray*, nsIVariant**) + 462 (nsJSEnvironment.cpp:1981)
26  libgklayout.dylib             	0x11c22ad4 nsJSEventListener::HandleEvent(nsIDOMEvent*) + 1092 (nsCOMPtr.h:777)
27  libgklayout.dylib             	0x1196de2b nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEventListener*, nsIDOMEvent*, nsPIDOMEventTarget*, unsigned int) + 107 (nsEventListenerManager.cpp:1091)
28  libgklayout.dylib             	0x1196e85e nsEventListenerManager::HandleEvent(nsPresContext*, nsEvent*, nsIDOMEvent**, nsPIDOMEventTarget*, unsigned int, nsEventStatus*) + 1598 (nsEventListenerManager.cpp:1196)
29  libgklayout.dylib             	0x119ac182 nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor&, unsigned int, int) + 210 (nsCOMPtr.h:975)
30  libgklayout.dylib             	0x119ac5af nsEventTargetChainItem::HandleEventTargetChain(nsEventChainPostVisitor&, unsigned int, nsDispatchingCallback*, int) + 639 (nsEventDispatcher.cpp:324)
31  libgklayout.dylib             	0x119ad422 nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, nsEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*) + 2786 (nsEventDispatcher.cpp:514)
32  libgklayout.dylib             	0x1181a6da nsXULPopupShownEvent::Run() + 250 (nsGUIEvent.h:726)
33  libxpcom_core.dylib           	0x003cc402 nsThread::ProcessNextEvent(int, int*) + 450 (nsThread.cpp:511)
34  libxpcom_core.dylib           	0x00359057 NS_ProcessPendingEvents_P(nsIThread*, unsigned int) + 71 (nsThreadUtils.cpp:181)
35  libwidget_mac.dylib           	0x139e5ca2 nsBaseAppShell::NativeEventCallback() + 98 (nsBaseAppShell.cpp:122)
36  libwidget_mac.dylib           	0x139a3f4a nsAppShell::ProcessGeckoEvents(void*) + 634 (nsAppShell.mm:374)
37  com.apple.CoreFoundation      	0x96f6f615 CFRunLoopRunSpecific + 3141
38  com.apple.CoreFoundation      	0x96f6fcf8 CFRunLoopRunInMode + 88
39  com.apple.HIToolbox           	0x9451f480 RunCurrentEventLoopInMode + 283
40  com.apple.HIToolbox           	0x9451f299 ReceiveNextEventCommon + 374
41  com.apple.HIToolbox           	0x9451f10d BlockUntilNextEventMatchingListInMode + 106
42  com.apple.AppKit              	0x92dfc23d _DPSNextEvent + 657
43  com.apple.AppKit              	0x92dfbaf0 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128
44  com.apple.AppKit              	0x92df4b2b -[NSApplication run] + 795
45  libwidget_mac.dylib           	0x139a36aa nsAppShell::Run() + 282 (nsAppShell.mm:692)
46  libtoolkitcomps.dylib         	0x1376578e nsAppStartup::Run() + 158 (nsAppStartup.cpp:193)
47  XUL                           	0x000a6934 XRE_main + 20660 (nsAppRunner.cpp:3266)
48  org.mozilla.firefox           	0x00002870 main + 448 (nsBrowserApp.cpp:156)
49  org.mozilla.firefox           	0x00002022 _start + 216
50  org.mozilla.firefox           	0x00001f49 start + 41

Comment 1

[Neil Deakin]

Did you run the toolkit (and chrome) tests with this patch on all platforms? The popup tests are quite susceptible to event ordering issues. 

I don't think delaying clearing the open attribute on popup close will cause an issue. The only thing I can think of is that is could cause a delayed redraw on a menu label.

I'll test this a bit tomorrow.

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

(In reply to comment #1)
> Did you run the toolkit (and chrome) tests with this patch on all platforms?
No I didn't. I don't have access to Windows, only Linux and OSX.

> I'll test this a bit tomorrow.
That would be great!

Note, script blockers aren't asynchronous in the same way as normal nsIRunnables,
but they usually run when the blockers are removed from stack. So this might
not change the painting behavior that badly.

Comment 3

[Neil Deakin]

Comment on attachment 349602 [details] [diff] [review]
Use a script runner to unset attribute

I tested this on Windows and Mac, ran the popup, menu and template tests and see no issues.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 349602 [details] [diff] [review]
Use a script runner to unset attribute

I did run the tests on linux and mac.

Comment 5

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 349602 [details] [diff] [review]
Use a script runner to unset attribute

Better take this now than on a branch

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

fixed on trunk and 1.9.1

Comment 7

[Steve England [:stevee]]

Should this bug have the fixed1.9.1 keyword?