473974 - Running mochitest asserts: ASSERTION: Element without owner document

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Olli Pettay [:smaug][[e-mail]]]

The assertion is something quite new, I think.
(And the assertion shouldn't be an assertion but a warning, at least until
 we change elements to own their owner document)

Maybe something is missing IsIndoc() or GetOwnerDoc() check.

###!!! ASSERTION: Element without owner document: 'Error', file /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/base/src/nsGenericElement.cpp, line 2987

#7  0x00002aaab0977cab in nsGenericElement::GetBaseURI (this=<value optimized out>)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/base/src/nsGenericElement.cpp:2987
#8  0x00002aaab09f9702 in nsGenericHTMLElement::GetBaseURI (this=0x3b17880)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/html/content/src/nsGenericHTMLElement.cpp:1238
#9  0x00002aaab09f6d1d in nsGenericHTMLElement::GetHrefURIForAnchors (this=0x3b17880, aURI=0x7fff50946ab0)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/html/content/src/nsGenericHTMLElement.cpp:1066
#10 0x00002aaab09f2ef9 in nsHTMLDNSPrefetch::nsDeferrals::SubmitQueue (this=0xe2b270)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/html/content/src/nsHTMLDNSPrefetch.cpp:286
#11 0x00002aaab09f307a in nsHTMLDNSPrefetch::nsDeferrals::OnStateChange (this=0xe2b270, aWebProgress=<value optimized out>, 
    aRequest=<value optimized out>, progressStateFlags=131088, aStatus=<value optimized out>)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/html/content/src/nsHTMLDNSPrefetch.cpp:363
#12 0x00002aaab28dafbc in nsDocLoader::FireOnStateChange (this=0xccaba0, aProgress=0x2c45a58, aRequest=0x35624f0, 
    aStateFlags=131088, aStatus=0) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/uriloader/base/nsDocLoader.cpp:1235
#13 0x00002aaab28dafe6 in nsDocLoader::FireOnStateChange (this=0x103b550, aProgress=0x2c45a58, aRequest=0x35624f0, 
    aStateFlags=131088, aStatus=0) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/uriloader/base/nsDocLoader.cpp:1242
#14 0x00002aaab28dafe6 in nsDocLoader::FireOnStateChange (this=0x151a600, aProgress=0x2c45a58, aRequest=0x35624f0, 
    aStateFlags=131088, aStatus=0) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/uriloader/base/nsDocLoader.cpp:1242
#15 0x00002aaab28dafe6 in nsDocLoader::FireOnStateChange (this=0x2c45a30, aProgress=0x2c45a58, aRequest=0x35624f0, 
    aStateFlags=131088, aStatus=0) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/uriloader/base/nsDocLoader.cpp:1242
#16 0x00002aaab28db1de in nsDocLoader::doStopDocumentLoad (this=0x2c45a30, request=0x35624f0, aStatus=0)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/uriloader/base/nsDocLoader.cpp:858
#17 0x00002aaab28dc2e2 in nsDocLoader::DocLoaderIsEmpty (this=0x2c45a30)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/uriloader/base/nsDocLoader.cpp:763
#18 0x00002aaab28dc44f in nsDocLoader::OnStopRequest (this=0x2c45a30, aRequest=0x2aaabcb3d890, aCtxt=<value optimized out>, 
    aStatus=0) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/uriloader/base/nsDocLoader.cpp:679
#19 0x00002aaab714cf91 in nsLoadGroup::RemoveRequest (this=0x2c53f20, request=0x2aaabcb3d890, ctxt=0x0, aStatus=0)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/netwerk/base/src/nsLoadGroup.cpp:688
#20 0x00002aaab0950c03 in nsDocument::DoUnblockOnload (this=0x2aaabd5c0b50)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/base/src/nsDocument.cpp:7063
#21 0x00002aaab0956382 in nsDocument::DispatchContentLoadedEvents (this=0x2aaabd5c0b50)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/base/src/nsDocument.cpp:3973
#22 0x00002aaab095b59d in nsRunnableMethod<nsDocument>::Run (this=0xffffffffffffffff)
    at ../../../dist/include/xpcom/nsThreadUtils.h:264
#23 0x00002aaaab27e121 in nsThread::ProcessNextEvent (this=0x66bfa0, mayWait=1, result=0x7fff509472ac)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/xpcom/threads/nsThread.cpp:510
#24 0x00002aaaab23b7e7 in NS_ProcessNextEvent_P (thread=0x2391, mayWait=1) at nsThreadUtils.cpp:230
#25 0x00002aaab9df7af6 in nsBaseAppShell::Run (this=0xced9b0)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:170
#26 0x00002aaab766e821 in nsAppStartup::Run (this=0xcd7050)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:192
---Type <return> to continue, or q <return> to quit---
#27 0x00002aaaaaae9fd9 in XRE_main (argc=<value optimized out>, argv=<value optimized out>, aAppData=<value optimized out>)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/toolkit/xre/nsAppRunner.cpp:3210
#28 0x0000000000400eca in main (argc=5, argv=0x0)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/browser/app/nsBrowserApp.cpp:156

Comment 1

[Boris Zbarsky [:bzbarsky]]

Er, yes.  The owner document might have gone away by the time we go to process the queue.  We should probably check GetOwnerDoc(), and if it's null just not prefetch the element.

Comment 2

[Patrick McManus [:mcmanus]]

Attachment: dont do a deferred dns lookup if ownerdoc() has gone away

if I understand the comments correctly, the patch needed is attached.

while it is a sensible optimization, I don't see a safety problem.. if the elements are still reference counted where does the danger of constructing the uri from them come in? If they in turn depend on something else, shouldn't they be holding that reference?

Comment 3

[Boris Zbarsky [:bzbarsky]]

> If they in turn depend on something else, shouldn't they be holding that
> reference?

In theory, yes.  In practice, that wasn't done to avoid reference cycles (back before we had a cycle collector).  See bug 335998.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 357389 [details] [diff] [review]
dont do a deferred dns lookup if ownerdoc() has gone away

Looks good.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Pushed http://hg.mozilla.org/mozilla-central/rev/657eaadd09b1

This needs to go in on branch too.

Comment 6

[Johnny Stenback (:jst)]

Comment on attachment 357389 [details] [diff] [review]
dont do a deferred dns lookup if ownerdoc() has gone away

This is a blocker now, doesn't need approval. Please land this for 1.9.1  whenever possible!

Comment 7

[Boris Zbarsky [:bzbarsky]]

Pushed http://hg.mozilla.org/releases/mozilla-1.9.1/rev/d6878078119b