511467 - "ASSERTION: Uh, IsInModalState() called w/o a reachable top window?" calling alert() from XBL destructor

Status: RESOLVED WONTFIX

(Core :: XBL, defect)

Description

[Jesse Ruderman]

Attachment: testcase (triggers assertion when window is closed)

Steps to reproduce:
1. Open the testcase.
2. Close the window.

Result:

JavaScript error: , line 0: uncaught exception: [Exception... "Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILABLE) [nsIDOMWindowInternal.alert]"  nsresult: "0x80040111 (NS_ERROR_NOT_AVAILABLE)"  location: "JS frame :: file:///Users/jruderman/fuzzing/lithium/a.xhtml ::  :: line 14"  data: no]

###!!! ASSERTION: Uh, IsInModalState() called w/o a reachable top window?: 'Error', file /Users/jruderman/central/dom/base/nsGlobalWindow.cpp, line 5763

Comment 1

[Jesse Ruderman]

Bug 404828 mentions one or two other ways to trigger this assertion.

Comment 2

[Jesse Ruderman]

Attachment: stack trace

Comment 3

[Marco Bonardo [:mak]]

I'm constantly able to hit the assertion when running toolkit/mozapps/extensions/test/browser/test_about.js alone. This test opens a modal dialog from the addons manager right frame.

When exiting modal state nsAutoWindowStateHelper goes out of scope
nsAutoWindowStateHelper::~nsAutoWindowStateHelper(void) calls
nsGlobalWindow::LeaveModalState(nsIDOMWindow *)
A nsPendingTimeoutRunner runnable is created and dispatched to main-thread

now I see a nsDocShell::Destroy() that calls win->SetDocShell(nsnull), this is its stack:
xul.dll!nsDocShell::Destroy() 
	xul.dll!nsFrameLoader::Finalize() 
	xul.dll!nsDocument::MaybeInitializeFinalizeFrameLoaders() 
	xul.dll!nsDocument::EndUpdate() 
	xul.dll!nsXULDocument::EndUpdate() 
	xul.dll!mozAutoDocUpdate::~mozAutoDocUpdate() 
	xul.dll!nsINode::doRemoveChildAt() 
	xul.dll!nsGenericElement::RemoveChildAt() 
	xul.dll!nsXULElement::RemoveChildAt() 
	xul.dll!nsINode::RemoveChild() 
	xul.dll!nsIDOMNode_RemoveChild() 
	mozjs.dll!js::CallJSNative()

At this point I see the same stack as Jesse (reversed to easy reading):

nsPendingTimeoutRunner:Run
RunPendingTimeoutsRecursive
(in RunPendingTimeoutsRecursive) inner->RunTimeout(nsnull);
IsInModalState()
GetTop()
(in GetTop) mDocShell IS NULL (this is the same window where SetDocShell(nsnull) was called in nsDocShell::Destroy())
###!!! ASSERTION: Uh, IsInModalState() called w/o a reachable top window?

Comment 4

[Marco Bonardo [:mak]]

What could be happening in browser_about.js is:
1. the test closes the modal dialog
2. this causes a domwindowclosed to be notified
3. the test on domwindowclosed enqueues a function that closes the addons manager
4. the modal dialog is destroyed and this brings to ~nsAutoWindowStateHelper
5. LeaveModalState enqueues the nsPendingTimeoutRunner runnable
6. at this point the addons manager gets closed by the function enqueued at 3.
7. mDocShells for about:addons are destroyed
8. nsPendingTimeoutRunner enqueued at 5. runs and brings to IsInModalState()
9. the mDocShell has already been destroyed and GetTop returns nsnull

Comment 5

[Boris Zbarsky [:bzbarsky]]

XBL is now disabled in Firefox (Bug 1583314) and is in the process of being removed from Gecko (Bug 1566221), so closing bugs requesting changes to its implementation as wontfix.