604760 - Compartment Mismatch crash due to textarea node resize?

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[David Dahl :ddahl]

in test: toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_588967_input_expansion.js

with the "lazy console" patches applied, I get this assertion/hang/crash:

TEST-PASS | chrome://mochitests/content/browser/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_588967_input_expansion.js | multiline is enabled
TEST-PASS | chrome://mochitests/content/browser/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_588967_input_expansion.js | the input expanded
TEST-PASS | chrome://mochitests/content/browser/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_588967_input_expansion.js | the input's height is normal again
WARNING: Positioned frame that does not handle positioned kids; looking further up the parent chain: file /home/ddahl/code/moz/mozilla-central/mozilla-central/layout/base/nsCSSFrameConstructor.cpp, line 5563
WARNING: Positioned frame that does not handle positioned kids; looking further up the parent chain: file /home/ddahl/code/moz/mozilla-central/mozilla-central/layout/base/nsCSSFrameConstructor.cpp, line 5563
WARNING: Positioned frame that does not handle positioned kids; looking further up the parent chain: file /home/ddahl/code/moz/mozilla-central/mozilla-central/layout/base/nsCSSFrameConstructor.cpp, line 5563
WARNING: Positioned frame that does not handle positioned kids; looking further up the parent chain: file /home/ddahl/code/moz/mozilla-central/mozilla-central/layout/base/nsCSSFrameConstructor.cpp, line 5563
*** Compartment mismatch 0x45584800 vs. 0x465f5800
Assertion failure: compartment mismatched, at /home/ddahl/code/moz/mozilla-central/mozilla-central/js/src/jscntxtinlines.h:513
TEST-UNEXPECTED-FAIL | chrome://mochitests/content/browser/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_588967_input_expansion.js | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:00:38.603234
INFO | automation.py | Reading PID log: /tmp/tmpEjbp_ipidlog
PROCESS-CRASH | chrome://mochitests/content/browser/toolkit/components/console/hudservice/tests/browser/browser_webconsole_bug_588967_input_expansion.js | application crashed (minidump found)
Neither MINIDUMP_STACKWALK nor MINIDUMP_STACKWALK_CGI is set, can't process dump.


*** Compartment mismatch 0xb0990000 vs. 0xac78d000
Assertion failure: compartment mismatched, at /home/ddahl/code/moz/mozilla-central/mozilla-central/js/src/jscntxtinlines.h:513

Program ./dist/bin/firefox-bin (pid = 8395) received signal 6.

Will attach the backtrace

Comment 1

[David Dahl :ddahl]

Attachment: bt

Comment 2

[David Dahl :ddahl]

call DumpJSStack output:

0 JSPropertyProvider(aInputValue = "foo", aScope = [object XrayWrapper [object Window @ 0xa9001b40 (native @ 0xad96ed78)]]) ["resource:///modules/HUDService.jsm":3939]
    matches = 
    prop = undefined
    matchProp = "foo"
    properties = foo
    completionPart = "foo"
    beginning = [object Object]
    obj = [object XrayWrapper [object Window @ 0xa9001b40 (native @ 0xad96ed78)]]
    this = [object Object]
1 JSTF_complete(type = 2) ["resource:///modules/HUDService.jsm":4728]
    completionStr = undefined
    matchOffset = undefined
    matchIndexToUse = undefined
    matches = undefined
    selEnd = 3
    selStart = 3
    inputValue = "foo"
    inputNode = [object XULElement @ 0xa62929c0 (native @ 0xa6292740)]
    this = [object Object]
2 anonymous(114) ["resource:///modules/HUDService.jsm":4585]
    this = [object ChromeWindow @ 0xaf1a5a00 (native @ 0xb3bab158)]

Comment 3

[Andreas Gal :gal]

Thanks for the stack and the report. How can I reproduce this?

Comment 4

[David Dahl :ddahl]

I have a feeling the way we are setting up the sandbox is the issue here:

http://mxr.mozilla.org/mozilla-central/source/toolkit/components/console/hudservice/HUDService.jsm#4142

Comment 5

[David Dahl :ddahl]

(In reply to comment #3)
> Thanks for the stack and the report. How can I reproduce this?

I was just about to add that you need the patches from bug 568629 and bug 587734 applied, then rebuild like so:

make -C dom && make -C layout/build && make -C toolkit && make -C toolkit/library && make -C browser

Comment 6

[Johnny Stenback (:jst)]

Blocking beta8. Blake, let me know if you think this one needs to block beta7.

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

Moving to b7, but if mrbkap answers comment 6 in the negative, we'll push it back to b8

Comment 8

[Damon Sicore (:damons)]

Assigning to blake.  Blake please address Comment 6.

Comment 9

[Johnny Stenback (:jst)]

I think this was actually due to a bug in one of the patches in bug 568629, which I just uploaded a fixed version for.

Comment 10

[David Dahl :ddahl]

 (In reply to comment #9)
> I think this was actually due to a bug in one of the patches in bug 568629,
> which I just uploaded a fixed version for.

In fact, this bug may have been due to the way we were getting the console as a wrappedJSObject in the JSTerm constructor. see bug 604431

I have not seen this error since landing that patch.

Sorry, I have been out of the loop on PTO.

Comment 11

[Johnny Stenback (:jst)]

Marking FIXED per previous comment(s).