604176 - dom/src/threads/test/test_longThread.html | Exited with code 1 during test run [@ nsAttrValue::GetSVGValue]

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Mats Palmgren (inactive)]

This is similar to bug 602772.

dom/src/threads/test/test_longThread.html | Exited with code 1 during test run [@ nsAttrValue::GetSVGValue]

This is on TryServer but it's unlikely my patch is the cause.
Rev3 MacOSX Leopard 10.5.8 tryserver debug test mochitests-2/5 on 2010/10/13 13:12:24
http://tinderbox.mozilla.org/showlog.cgi?log=MozillaTry/1287000744.1287001235.10070.gz&fulltext=1


Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0xffffffff89550008

Thread 0 (crashed)
 0  nsAttrValue::GetSVGValue [nsAttrValue.h:03346f5b2b76 : 451 + 0xb]
    eip = 0x033bed65   esp = 0xbfff8f10   ebp = 0xbfff8f38   ebx = 0x033bed12
    esi = 0x0342d954   edi = 0x00000000   eax = 0x89550000   ecx = 0x00000000
    edx = 0x00000000   efl = 0x00210282
    Found by: given as instruction pointer in context
 1  nsSVGElement::GetModificationDataForObservable [nsSVGElement.cpp:03346f5b2b76 : 1034 + 0xa]
 2  nsSVGElement::DidModifySVGObservable [nsSVGElement.cpp:03346f5b2b76 : 1079 + 0x18]
 3  nsGenericElement::HasAttribute [nsGenericElement.cpp:03346f5b2b76 : 2645 + 0x1a]
 4  nsSVGSVGElement::HasAttribute [nsSVGSVGElement.h:03346f5b2b76 : 153 + 0x18]
 5  nsXPCOMCycleCollectionParticipant::CheckForRightISupports [nsCycleCollectionParticipant.cpp : 101 + 0x3c]
 6  nsXPCWrappedJS::cycleCollection::Traverse [xpcwrappedjs.cpp:03346f5b2b76 : 56 + 0x11]
 7  GCGraphBuilder::Traverse [nsCycleCollector.cpp:03346f5b2b76 : 1487 + 0x24]
 8  nsCycleCollector::MarkRoots [nsCycleCollector.cpp:03346f5b2b76 : 1728 + 0x11]
 9  nsCycleCollector::BeginCollection [nsCycleCollector.cpp:03346f5b2b76 : 2608 + 0x14]
10  nsCycleCollector::Collect [nsCycleCollector.cpp:03346f5b2b76 : 2486 + 0x11]
11  nsCycleCollector_collect [nsCycleCollector.cpp:03346f5b2b76 : 3199 + 0x2a]
12  nsJSContext::CC [nsJSEnvironment.cpp:03346f5b2b76 : 3531 + 0xa]
13  nsJSContext::IntervalCC [nsJSEnvironment.cpp:03346f5b2b76 : 3619 + 0xb]
14  nsJSContext::CCIfUserInactive [nsJSEnvironment.cpp:03346f5b2b76 : 3609 + 0x4]
15  nsJSContext::LoadEnd [nsJSEnvironment.cpp:03346f5b2b76 : 3675 + 0x4]
16  DocumentViewerImpl::LoadComplete [nsDocumentViewer.cpp:03346f5b2b76 : 1084 + 0x4]
17  nsDocShell::EndPageLoad [nsDocShell.cpp:03346f5b2b76 : 5995 + 0x24]
18  nsDocShell::OnStateChange [nsDocShell.cpp:03346f5b2b76 : 5855 + 0x32]
19  nsDocLoader::FireOnStateChange [nsDocLoader.cpp:03346f5b2b76 : 1334 + 0x34]
20  nsDocLoader::doStopDocumentLoad [nsDocLoader.cpp:03346f5b2b76 : 942 + 0x2a]
21  nsDocLoader::DocLoaderIsEmpty [nsDocLoader.cpp:03346f5b2b76 : 818 + 0x20]
22  nsDocLoader::OnStopRequest [nsDocLoader.cpp:03346f5b2b76 : 702 + 0x12]
23  nsLoadGroup::RemoveRequest [nsLoadGroup.cpp:03346f5b2b76 : 680 + 0x2d]
24  nsHttpChannel::OnStopRequest [nsHttpChannel.cpp:03346f5b2b76 : 3971 + 0x34]
25  nsInputStreamPump::OnStateStop [nsInputStreamPump.cpp:03346f5b2b76 : 578 + 0x42]
26  nsInputStreamPump::OnInputStreamReady [nsInputStreamPump.cpp:03346f5b2b76 : 403 + 0xa]
27  nsInputStreamReadyEvent::Run [nsStreamUtils.cpp:03346f5b2b76 : 112 + 0x2d]
28  nsThread::ProcessNextEvent [nsThread.cpp:03346f5b2b76 : 547 + 0x18]
29  NS_ProcessPendingEvents_P [nsThreadUtils.cpp : 200 + 0x20]
...

There are a couple of assertions before the crash:
###!!! ASSERTION: WrappedNativeSuspecter attempting to touch dead object: '!JS_IsAboutToBeFinalized(closure->cx, wrapper->GetFlatJSObject())', file /builds/slave/tryserver-macosx-debug/build/js/src/xpconnect/src/xpcwrappednativescope.cpp, line 422
WrappedNativeSuspecter [js/src/xpconnect/src/xpcwrappednativescope.cpp:426]
###!!! ASSERTION: wrong type: 'Type() == eSVGValue', file /builds/slave/tryserver-macosx-debug/build/content/svg/content/src/../../../base/src/nsAttrValue.h, line 450
###!!! ASSERTION: wrong type: 'BaseType() == eOtherBase', file /builds/slave/tryserver-macosx-debug/build/layout/generic/../../content/base/src/nsAttrValue.h, line 506

I'll attach a snippet from the log to save the assertion stacks.

Comment 1

[Mats Palmgren (inactive)]

Attachment: log snippet

Comment 2

[Daniel Holbert [:dholbert]]

I don't claim to know what's going on, but my guess is we're hosed (working with something deleted/dead?) after this first assertion failure from comment 0:
###!!! ASSERTION: WrappedNativeSuspecter attempting to touch dead object:
'!JS_IsAboutToBeFinalized(closure->cx, wrapper->GetFlatJSObject())', file
/builds/slave/tryserver-macosx-debug/build/js/src/xpconnect/src/xpcwrappednativescope.cpp,
line 422

hg blame says Andreas added that assertion -- Andreas, can you offer any insight into what that failure means?

Note: though bug 602772's log has a similar stack, it doesn't have any assertion-failures at all.

Comment 3

[Robert Longson [:longsonr]]

 nsAttrValue::GetSVGValue, nsSVGElement::GetModificationDataForObservable and nsSVGElement::DidModifySVGObservable have all been removed by bug 690486 now.