543131 - XPC_WN_JSOp_ThisObject calls JS_GetScopeChain without a request

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Luke Wagner [:luke]]

This is with Firebug 1.5 with a TraceMonkey tip debug build of Firefox on Ubuntu.

Steps to Reproduce:
 1. start Firefox
 2. enable Script debugging (also works if it is enabled on startup)
 3. navigate to google.com
 4. click the 'more' link (so its onclick script appears in the list)
 5. in the script debugging panel, select the event:
      function onclick(event) { this.blur(); gbar.tg(event); return false; }
 6. put a break point anywhere in the middle
 7. click 'more' again
 8. assertion:

#1  0xb61fec81 in JS_Assert (s=0xb628e7a0 "(cx)->requestDepth || (cx)->thread == (cx)->runtime->gcThread", 
    file=0xb628e77c "/moz/safemonkey/js/src/jsapi.cpp", ln=1813) at /moz/safemonkey/js/src/jsutil.cpp:70
#2  0xb60eb8c2 in JS_GetScopeChain (cx=0xafa2d800) at /moz/safemonkey/js/src/jsapi.cpp:1813
#3  0xb660b800 in XPC_WN_JSOp_ThisObject (cx=0xafa2d800, obj=0xaab3ab80) at /moz/safemonkey/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1479
#4  0xb6173ab3 in JSObject::thisObject (this=0xaab3ab80, cx=0xafa2d800) at /moz/safemonkey/js/src/jsobj.h:400
#5  0xb61708a2 in CallThisObjectHook (cx=0xafa2d800, obj=0xaab3ab80, argv=0xaa845028) at /moz/safemonkey/js/src/jsinterp.cpp:868
#6  0xb6170c04 in ComputeThis (cx=0xafa2d800, lazy=1, argv=0xaa845028) at /moz/safemonkey/js/src/jsinterp.cpp:964
#7  0xb6170c96 in js_ComputeThis (cx=0xafa2d800, lazy=1, argv=0xaa845028) at /moz/safemonkey/js/src/jsinterp.cpp:973
#8  0xb6113d72 in JS_GetFrameThis (cx=0xafa2d800, fp=0xbfffd2cc) at /moz/safemonkey/js/src/jsdbgapi.cpp:1242
#9  0xb74e207d in jsd_GetThisForStackFrame (jsdc=0xabdbeef0, jsdthreadstate=0xaa844be0, jsdframe=0xaa844c00) at /moz/safemonkey/js/jsd/jsd_stak.c:342
#10 0xb74dc252 in JSD_GetThisForStackFrame (jsdc=0xabdbeef0, jsdthreadstate=0xaa844be0, jsdframe=0xaa844c00) at /moz/safemonkey/js/jsd/jsdebug.c:752
#11 0xb74eb381 in jsdStackFrame::GetThisValue (this=0xaa7cdd00, _rval=0xbfff9dd0) at /moz/safemonkey/js/jsd/jsd_xpc.cpp:1944
#12 0xb79325c9 in NS_InvokeByIndex_P () at /moz/safemonkey/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp:69
#13 0xb65fe4d9 in XPCWrappedNative::CallMethod (ccx=..., mode=XPCWrappedNative::CALL_GETTER)
    at /moz/safemonkey/js/src/xpconnect/src/xpcwrappednative.cpp:2727
#14 0xb660e23b in XPCWrappedNative::GetAttribute (ccx=...) at /moz/safemonkey/js/src/xpconnect/src/xpcprivate.h:2547
#15 0xb660c807 in XPC_WN_GetterSetter (cx=0xb4c11200, obj=0xaab0fd20, argc=0, argv=0xabd01650, vp=0xbfffa27c)
    at /moz/safemonkey/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1800
#16 0xb6171a45 in js_Invoke (cx=0xb4c11200, argc=0, vp=0xabd01648, flags=2) at /moz/safemonkey/js/src/jsinterp.cpp:1380
#17 0xb6171cfd in js_InternalInvoke (cx=0xb4c11200, obj=0xaab0fd20, fval=-1431232704, flags=0, argc=0, argv=0x0, rval=0xbfffa7a4)
    at /moz/safemonkey/js/src/jsinterp.cpp:1443
#18 0xb6171e14 in js_InternalGetOrSet (cx=0xb4c11200, obj=0xaab0fd20, id=-1323213564, fval=-1431232704, mode=JSACC_READ, argc=0, argv=0x0, 
    rval=0xbfffa7a4) at /moz/safemonkey/js/src/jsinterp.cpp:1480
#19 0xb6191e91 in JSScopeProperty::get (this=0xabcc9010, cx=0xb4c11200, obj=0xaab0fd20, pobj=0xaab0fd20, vp=0xbfffa7a4)
    at /moz/safemonkey/js/src/jsscope.h:831
#20 0xb618afcb in js_NativeGet (cx=0xb4c11200, obj=0xaab0fd20, pobj=0xaab0fd20, sprop=0xabcc9010, getHow=1, vp=0xbfffa7a4)
    at /moz/safemonkey/js/src/jsobj.cpp:5018
#21 0xb618bb37 in js_GetPropertyHelper (cx=0xb4c11200, obj=0xaab0fd20, id=-1323213564, getHow=1, vp=0xbfffa7a4) at /moz/safemonkey/js/src/jsobj.cpp:5194
#22 0xb6159e82 in js_Interpret (cx=0xb4c11200) at /moz/safemonkey/js/src/jsops.cpp:1544
#23 0xb6171a8e in js_Invoke (cx=0xb4c11200, argc=2, vp=0xabd013f0, flags=0) at /moz/safemonkey/js/src/jsinterp.cpp:1388
#24 0xb6138a1f in js_fun_apply (cx=0xb4c11200, argc=2, vp=0xabd013b8) at /moz/safemonkey/js/src/jsfun.cpp:2079
#25 0xb615e38b in js_Interpret (cx=0xb4c11200) at /moz/safemonkey/js/src/jsops.cpp:2271
#26 0xb6171a8e in js_Invoke (cx=0xb4c11200, argc=1, vp=0xaaa357dc, flags=0) at /moz/safemonkey/js/src/jsinterp.cpp:1388
#27 0xb6138a1f in js_fun_apply (cx=0xb4c11200, argc=1, vp=0xaaa357a4) at /moz/safemonkey/js/src/jsfun.cpp:2079
#28 0xb615e38b in js_Interpret (cx=0xb4c11200) at /moz/safemonkey/js/src/jsops.cpp:2271
#29 0xb6171a8e in js_Invoke (cx=0xb4c11200, argc=0, vp=0xaaa35720, flags=0) at /moz/safemonkey/js/src/jsinterp.cpp:1388
#30 0xb65f4b44 in nsXPCWrappedJSClass::CallMethod (this=0xaa7d2100, wrapper=0xaa7cccc0, methodIndex=3, info=0xb117c870, nativeParams=0xbfffb7bc)
    at /moz/safemonkey/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1696
#31 0xb65eb6db in nsXPCWrappedJS::CallMethod (this=0xaa7cccc0, methodIndex=3, info=0xb117c870, params=0xbfffb7bc)
    at /moz/safemonkey/js/src/xpconnect/src/xpcwrappedjs.cpp:570
#32 0xb7932841 in PrepareAndDispatch (methodIndex=3, self=0xaa76d160, args=0xbfffb888)
    at /moz/safemonkey/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp:95
#33 0xb74ee4c3 in jsdService::EnterNestedEventLoop (this=0xafaa8380, callback=0xaa76d160, _rval=0xbfffb96c) at /moz/safemonkey/js/jsd/jsd_xpc.cpp:3037
#34 0xb79325c9 in NS_InvokeByIndex_P () at /moz/safemonkey/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_gcc_x86_unix.cpp:69
#35 0xb65fe4d9 in XPCWrappedNative::CallMethod (ccx=..., mode=XPCWrappedNative::CALL_METHOD)
    at /moz/safemonkey/js/src/xpconnect/src/xpcwrappednative.cpp:2727
#36 0xb660c446 in XPC_WN_CallMethod (cx=0xafa2d800, obj=0xac1249a0, argc=1, argv=0xaa8452f4, vp=0xbfffbde8)
    at /moz/safemonkey/js/src/xpconnect/src/xpcwrappednativejsops.cpp:1756
#37 0xb6171a45 in js_Invoke (cx=0xafa2d800, argc=1, vp=0xaa8452ec, flags=2) at /moz/safemonkey/js/src/jsinterp.cpp:1380
#38 0xb615e527 in js_Interpret (cx=0xafa2d800) at /moz/safemonkey/js/src/jsops.cpp:2305
#39 0xb6171a8e in js_Invoke (cx=0xafa2d800, argc=3, vp=0xaa8450a0, flags=0) at /moz/safemonkey/js/src/jsinterp.cpp:1388
#40 0xb6138a1f in js_fun_apply (cx=0xafa2d800, argc=3, vp=0xaa845068) at /moz/safemonkey/js/src/jsfun.cpp:2079
#41 0xb615e38b in js_Interpret (cx=0xafa2d800) at /moz/safemonkey/js/src/jsops.cpp:2271
#42 0xb6171a8e in js_Invoke (cx=0xafa2d800, argc=3, vp=0xaa84504c, flags=0) at /moz/safemonkey/js/src/jsinterp.cpp:1388
#43 0xb65f4b44 in nsXPCWrappedJSClass::CallMethod (this=0xabcb0700, wrapper=0xabcc1dc0, methodIndex=3, info=0xb117bfb8, nativeParams=0xbfffcc68)
    at /moz/safemonkey/js/src/xpconnect/src/xpcwrappedjsclass.cpp:1696
#44 0xb65eb6db in nsXPCWrappedJS::CallMethod (this=0xabcc1dc0, methodIndex=3, info=0xb117bfb8, params=0xbfffcc68)
    at /moz/safemonkey/js/src/xpconnect/src/xpcwrappedjs.cpp:570
#45 0xb7932841 in PrepareAndDispatch (methodIndex=3, self=0xabcc2300, args=0xbfffcd34)
    at /moz/safemonkey/xpcom/reflect/xptcall/src/md/unix/xptcstubs_gcc_x86_unix.cpp:95
#46 0xb74e70f9 in jsds_ExecutionHookProc (jsdc=0xabdbeef0, jsdthreadstate=0xaa844be0, type=1, callerdata=0x1, rval=0xbfffd1c0)
    at /moz/safemonkey/js/jsd/jsd_xpc.cpp:682
#47 0xb74de91a in jsd_CallExecutionHook (jsdc=0xabdbeef0, cx=0xafa2d800, type=1, hook=0xb74e6d53 <jsds_ExecutionHookProc>, hookData=0x1, rval=0xbfffd1c0)
    at /moz/safemonkey/js/jsd/jsd_hook.c:177
#48 0xb74e10b6 in jsd_TrapHandler (cx=0xafa2d800, script=0xabc7b510, pc=0xabc7b554 "SA\270", rval=0xbfffd1c0, closure=0xaa7d1781)
    at /moz/safemonkey/js/jsd/jsd_scpt.c:758
#49 0xb6111be3 in JS_HandleTrap (cx=0xafa2d800, script=0xabc7b510, pc=0xabc7b554 "SA\270", rval=0xbfffd1c0) at /moz/safemonkey/js/src/jsdbgapi.cpp:341
#50 0xb61614c6 in js_Interpret (cx=0xafa2d800) at /moz/safemonkey/js/src/jsops.cpp:2623
#51 0xb6171a8e in js_Invoke (cx=0xafa2d800, argc=1, vp=0xaa845020, flags=0) at /moz/safemonkey/js/src/jsinterp.cpp:1388
#52 0xb6171cfd in js_InternalInvoke (cx=0xafa2d800, obj=0xaab3ab80, fval=-1431079840, flags=0, argc=1, argv=0xaa893010, rval=0xbfffd490)
    at /moz/safemonkey/js/src/jsinterp.cpp:1443
#53 0xb60f4f8b in JS_CallFunctionValue (cx=0xafa2d800, obj=0xaab3ab80, fval=-1431079840, argc=1, argv=0xaa893010, rval=0xbfffd490)
    at /moz/safemonkey/js/src/jsapi.cpp:5122
#54 0xb6ea2a73 in nsJSContext::CallEventHandler (this=0xaf8d7940, aTarget=0xaaa38400, aScope=0xac124440, aHandler=0xaab37460, aargv=0xaa844bc0, 
    arv=0xbfffd62c) at /moz/safemonkey/dom/base/nsJSEnvironment.cpp:2164
#55 0xb6f2527e in nsJSEventListener::HandleEvent (this=0xaaa441a0, aEvent=0xaa8cbd60) at /moz/safemonkey/dom/src/events/nsJSEventListener.cpp:228
#56 0xb6cb9c2f in nsEventListenerManager::HandleEventSubType (this=0xabce7b80, aListenerStruct=0xabce7ba8, aListener=0xaaa441a0, aDOMEvent=0xaa8cbd60, 
    aCurrentTarget=0xaaa38400, aPhaseFlags=6, aPusher=0xbfffda44) at /moz/safemonkey/content/events/src/nsEventListenerManager.cpp:1057
#57 0xb6cba0f0 in nsEventListenerManager::HandleEvent (this=0xabce7b80, aPresContext=0xabc97400, aEvent=0xbfffdc40, aDOMEvent=0xbfffda34, 
    aCurrentTarget=0xaaa38400, aFlags=6, aEventStatus=0xbfffda38, aPusher=0xbfffda44)
    at /moz/safemonkey/content/events/src/nsEventListenerManager.cpp:1173
#58 0xb6ce5076 in nsEventTargetChainItem::HandleEvent (this=0xb03662a0, aVisitor=..., aFlags=6, aMayHaveNewListenerManagers=0, aPusher=0xbfffda44)
    at /moz/safemonkey/content/events/src/nsEventDispatcher.cpp:200
#59 0xb6ce306b in nsEventTargetChainItem::HandleEventTargetChain (this=0xb0366140, aVisitor=..., aFlags=6, aCallback=0xbfffdb18, 
    aMayHaveNewListenerManagers=0, aPusher=0xbfffda44) at /moz/safemonkey/content/events/src/nsEventDispatcher.cpp:325
#60 0xb6ce3c9d in nsEventDispatcher::Dispatch (aTarget=0xaaa38400, aPresContext=0xabc97400, aEvent=0xbfffdc40, aDOMEvent=0x0, aEventStatus=0xbfffe138, 
    aCallback=0xbfffdb18, aTargets=0x0) at /moz/safemonkey/content/events/src/nsEventDispatcher.cpp:600
#61 0xb69410a6 in PresShell::HandleEventInternal (this=0xac01beb0, aEvent=0xbfffdc40, aView=0x0, aStatus=0xbfffe138)
    at /moz/safemonkey/layout/base/nsPresShell.cpp:6522
#62 0xb6940bae in PresShell::HandleEventWithTarget (this=0xac01beb0, aEvent=0xbfffdc40, aFrame=0xaaa5d390, aContent=0xaaa38400, aStatus=0xbfffe138)
    at /moz/safemonkey/layout/base/nsPresShell.cpp:6385
#63 0xb6cc7ef7 in nsEventStateManager::CheckForAndDispatchClick (this=0xaf5f1d40, aPresContext=0xabc97400, aEvent=0xbfffe368, aStatus=0xbfffe138)
    at /moz/safemonkey/content/events/src/nsEventStateManager.cpp:4009
#64 0xb6cc5277 in nsEventStateManager::PostHandleEvent (this=0xaf5f1d40, aPresContext=0xabc97400, aEvent=0xbfffe368, aTargetFrame=0xaaa5d390, 
    aStatus=0xbfffe138, aView=0xabc58940) at /moz/safemonkey/content/events/src/nsEventStateManager.cpp:2919
#65 0xb6941250 in PresShell::HandleEventInternal (this=0xac01beb0, aEvent=0xbfffe368, aView=0xabc58940, aStatus=0xbfffe138)
    at /moz/safemonkey/layout/base/nsPresShell.cpp:6543
#66 0xb6940b48 in PresShell::HandlePositionedEvent (this=0xac01beb0, aView=0xabc58940, aTargetFrame=0xaaa5d390, aEvent=0xbfffe368, 
    aEventStatus=0xbfffe138) at /moz/safemonkey/layout/base/nsPresShell.cpp:6368
#67 0xb694033f in PresShell::HandleEvent (this=0xac01beb0, aView=0xabc58940, aEvent=0xbfffe368, aEventStatus=0xbfffe138)
    at /moz/safemonkey/layout/base/nsPresShell.cpp:6232
#68 0xb6e915b2 in nsViewManager::HandleEvent (this=0xabc588e0, aView=0xabc58940, aPoint=..., aEvent=0xbfffe368)
    at /moz/safemonkey/view/src/nsViewManager.cpp:1199
#69 0xb6e91516 in nsViewManager::DispatchEvent (this=0xabc588e0, aEvent=0xbfffe368, aView=0xabc58940, aStatus=0xbfffe27c)
    at /moz/safemonkey/view/src/nsViewManager.cpp:1178
#70 0xb6e88a27 in HandleEvent (aEvent=0xbfffe368) at /moz/safemonkey/view/src/nsView.cpp:167
#71 0xb76201db in nsWindow::DispatchEvent (this=0xaed83890, aEvent=0xbfffe368, aStatus=@0xbfffe3c8) at /moz/safemonkey/widget/src/gtk2/nsWindow.cpp:611
#72 0xb7626378 in nsWindow::OnButtonReleaseEvent (this=0xaed83890, aWidget=0xb1325e70, aEvent=0xa9716b00)
    at /moz/safemonkey/widget/src/gtk2/nsWindow.cpp:3080
#73 0xb762d5c0 in button_release_event_cb (widget=0xb1325e70, event=0xa9716b00) at /moz/safemonkey/widget/src/gtk2/nsWindow.cpp:5813
#74 0xb5ded474 in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#75 0xb5975072 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#76 0xb598a7a8 in ?? () from /usr/lib/libgobject-2.0.so.0
#77 0xb598b9b8 in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#78 0xb598bfb6 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#79 0xb5f0995e in ?? () from /usr/lib/libgtk-x11-2.0.so.0
#80 0xb5de5c20 in gtk_propagate_event () from /usr/lib/libgtk-x11-2.0.so.0
#81 0xb5de6ea9 in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#82 0xb5b7d62a in ?? () from /usr/lib/libgdk-x11-2.0.so.0
#83 0xb58e6e88 in g_main_context_dispatch () from /lib/libglib-2.0.so.0
#84 0xb58ea730 in ?? () from /lib/libglib-2.0.so.0
#85 0xb58ea863 in g_main_context_iteration () from /lib/libglib-2.0.so.0
#86 0xb7633b19 in nsAppShell::ProcessNextNativeEvent (this=0xb1154c40, mayWait=1) at /moz/safemonkey/widget/src/gtk2/nsAppShell.cpp:147
#87 0xb7656c13 in nsBaseAppShell::DoProcessNextNativeEvent (this=0xb1154c40, mayWait=1) at /moz/safemonkey/widget/src/xpwidgets/nsBaseAppShell.cpp:155
#88 0xb765704c in nsBaseAppShell::OnProcessNextEvent (this=0xb1154c40, thr=0xb4ccd3d0, mayWait=1, recursionDepth=0)
    at /moz/safemonkey/widget/src/xpwidgets/nsBaseAppShell.cpp:311
#89 0xb79179cf in nsThread::ProcessNextEvent (this=0xb4ccd3d0, mayWait=1, result=0xbfffeaac) at /moz/safemonkey/xpcom/threads/nsThread.cpp:508
#90 0xb78ad6bd in NS_ProcessNextEvent_P (thread=0xb4ccd3d0, mayWait=1) at nsThreadUtils.cpp:250
#91 0xb7796a87 in mozilla::ipc::MessagePump::Run (this=0xb4cc9880, aDelegate=0xb4c287c0) at /moz/safemonkey/ipc/glue/MessagePump.cpp:142
#92 0xb782d88b in MessageLoop::RunInternal (this=0xb4c287c0) at /moz/safemonkey/ipc/chromium/src/base/message_loop.cc:211
#93 0xb782d807 in MessageLoop::RunHandler (this=0xb4c287c0) at /moz/safemonkey/ipc/chromium/src/base/message_loop.cc:194
#94 0xb782d78b in MessageLoop::Run (this=0xb4c287c0) at /moz/safemonkey/ipc/chromium/src/base/message_loop.cc:168
#95 0xb7656cac in nsBaseAppShell::Run (this=0xb1154c40) at /moz/safemonkey/widget/src/xpwidgets/nsBaseAppShell.cpp:174
#96 0xb73d2507 in nsAppStartup::Run (this=0xb1009460) at /moz/safemonkey/toolkit/components/startup/src/nsAppStartup.cpp:182
#97 0xb657f064 in XRE_main (argc=3, argv=0xbffff284, aAppData=0xb4c18380) at /moz/safemonkey/toolkit/xre/nsAppRunner.cpp:3476
#98 0x08049aa7 in main (argc=3, argv=0xbffff284) at /moz/safemonkey/browser/app/nsBrowserApp.cpp:158

Comment 1

[timeless]

Attachment: proposal

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 430870 [details] [diff] [review]
proposal

It doesn't make sense to call this hook from outside a request. You seem to have come up with an alternative (and IMO correct) patch in bug 552599.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Sorry, I meant bug 552686.

Comment 4

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.

Comment 5

[Boris Zbarsky [:bzbarsky]]

XPC_WN_JSOp_ThisObject is long gone.