Running mochitest asserts: ASSERTION: Element without owner document

RESOLVED FIXED

Status

()

Core
DOM
P2
normal
RESOLVED FIXED
9 years ago
6 years ago

People

(Reporter: smaug, Assigned: mcmanus)

Tracking

({fixed1.9.1, regression})

Trunk
x86
Linux
fixed1.9.1, regression
Points:
---
Bug Flags:
blocking1.9.1 +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

9 years ago
The assertion is something quite new, I think.
(And the assertion shouldn't be an assertion but a warning, at least until
 we change elements to own their owner document)

Maybe something is missing IsIndoc() or GetOwnerDoc() check.

###!!! ASSERTION: Element without owner document: 'Error', file /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/base/src/nsGenericElement.cpp, line 2987

#7  0x00002aaab0977cab in nsGenericElement::GetBaseURI (this=<value optimized out>)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/base/src/nsGenericElement.cpp:2987
#8  0x00002aaab09f9702 in nsGenericHTMLElement::GetBaseURI (this=0x3b17880)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/html/content/src/nsGenericHTMLElement.cpp:1238
#9  0x00002aaab09f6d1d in nsGenericHTMLElement::GetHrefURIForAnchors (this=0x3b17880, aURI=0x7fff50946ab0)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/html/content/src/nsGenericHTMLElement.cpp:1066
#10 0x00002aaab09f2ef9 in nsHTMLDNSPrefetch::nsDeferrals::SubmitQueue (this=0xe2b270)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/html/content/src/nsHTMLDNSPrefetch.cpp:286
#11 0x00002aaab09f307a in nsHTMLDNSPrefetch::nsDeferrals::OnStateChange (this=0xe2b270, aWebProgress=<value optimized out>, 
    aRequest=<value optimized out>, progressStateFlags=131088, aStatus=<value optimized out>)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/html/content/src/nsHTMLDNSPrefetch.cpp:363
#12 0x00002aaab28dafbc in nsDocLoader::FireOnStateChange (this=0xccaba0, aProgress=0x2c45a58, aRequest=0x35624f0, 
    aStateFlags=131088, aStatus=0) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/uriloader/base/nsDocLoader.cpp:1235
#13 0x00002aaab28dafe6 in nsDocLoader::FireOnStateChange (this=0x103b550, aProgress=0x2c45a58, aRequest=0x35624f0, 
    aStateFlags=131088, aStatus=0) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/uriloader/base/nsDocLoader.cpp:1242
#14 0x00002aaab28dafe6 in nsDocLoader::FireOnStateChange (this=0x151a600, aProgress=0x2c45a58, aRequest=0x35624f0, 
    aStateFlags=131088, aStatus=0) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/uriloader/base/nsDocLoader.cpp:1242
#15 0x00002aaab28dafe6 in nsDocLoader::FireOnStateChange (this=0x2c45a30, aProgress=0x2c45a58, aRequest=0x35624f0, 
    aStateFlags=131088, aStatus=0) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/uriloader/base/nsDocLoader.cpp:1242
#16 0x00002aaab28db1de in nsDocLoader::doStopDocumentLoad (this=0x2c45a30, request=0x35624f0, aStatus=0)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/uriloader/base/nsDocLoader.cpp:858
#17 0x00002aaab28dc2e2 in nsDocLoader::DocLoaderIsEmpty (this=0x2c45a30)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/uriloader/base/nsDocLoader.cpp:763
#18 0x00002aaab28dc44f in nsDocLoader::OnStopRequest (this=0x2c45a30, aRequest=0x2aaabcb3d890, aCtxt=<value optimized out>, 
    aStatus=0) at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/uriloader/base/nsDocLoader.cpp:679
#19 0x00002aaab714cf91 in nsLoadGroup::RemoveRequest (this=0x2c53f20, request=0x2aaabcb3d890, ctxt=0x0, aStatus=0)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/netwerk/base/src/nsLoadGroup.cpp:688
#20 0x00002aaab0950c03 in nsDocument::DoUnblockOnload (this=0x2aaabd5c0b50)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/base/src/nsDocument.cpp:7063
#21 0x00002aaab0956382 in nsDocument::DispatchContentLoadedEvents (this=0x2aaabd5c0b50)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/content/base/src/nsDocument.cpp:3973
#22 0x00002aaab095b59d in nsRunnableMethod<nsDocument>::Run (this=0xffffffffffffffff)
    at ../../../dist/include/xpcom/nsThreadUtils.h:264
#23 0x00002aaaab27e121 in nsThread::ProcessNextEvent (this=0x66bfa0, mayWait=1, result=0x7fff509472ac)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/xpcom/threads/nsThread.cpp:510
#24 0x00002aaaab23b7e7 in NS_ProcessNextEvent_P (thread=0x2391, mayWait=1) at nsThreadUtils.cpp:230
#25 0x00002aaab9df7af6 in nsBaseAppShell::Run (this=0xced9b0)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:170
#26 0x00002aaab766e821 in nsAppStartup::Run (this=0xcd7050)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:192
---Type <return> to continue, or q <return> to quit---
#27 0x00002aaaaaae9fd9 in XRE_main (argc=<value optimized out>, argv=<value optimized out>, aAppData=<value optimized out>)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/toolkit/xre/nsAppRunner.cpp:3210
#28 0x0000000000400eca in main (argc=5, argv=0x0)
    at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/browser/app/nsBrowserApp.cpp:156
Er, yes.  The owner document might have gone away by the time we go to process the queue.  We should probably check GetOwnerDoc(), and if it's null just not prefetch the element.
Assignee: nobody → mcmanus
Blocks: 473089
Keywords: regression
(Assignee)

Comment 2

9 years ago
Created attachment 357389 [details] [diff] [review]
dont do a deferred dns lookup if ownerdoc() has gone away

if I understand the comments correctly, the patch needed is attached.

while it is a sensible optimization, I don't see a safety problem.. if the elements are still reference counted where does the danger of constructing the uri from them come in? If they in turn depend on something else, shouldn't they be holding that reference?
Attachment #357389 - Flags: review?(bzbarsky)
> If they in turn depend on something else, shouldn't they be holding that
> reference?

In theory, yes.  In practice, that wasn't done to avoid reference cycles (back before we had a cycle collector).  See bug 335998.
Comment on attachment 357389 [details] [diff] [review]
dont do a deferred dns lookup if ownerdoc() has gone away

Looks good.
Attachment #357389 - Flags: superreview+
Attachment #357389 - Flags: review?(bzbarsky)
Attachment #357389 - Flags: review+
Pushed http://hg.mozilla.org/mozilla-central/rev/657eaadd09b1

This needs to go in on branch too.
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Flags: blocking1.9.1?
Resolution: --- → FIXED
Attachment #357389 - Flags: approval1.9.1?

Updated

9 years ago
Flags: blocking1.9.1? → blocking1.9.1+
Priority: -- → P2
Comment on attachment 357389 [details] [diff] [review]
dont do a deferred dns lookup if ownerdoc() has gone away

This is a blocker now, doesn't need approval. Please land this for 1.9.1  whenever possible!
Attachment #357389 - Flags: approval1.9.1?
Pushed http://hg.mozilla.org/releases/mozilla-1.9.1/rev/d6878078119b
Keywords: fixed1.9.1
You need to log in before you can comment on or make changes to this bug.