61840 - document viewer allocates GC things during finalization

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P3)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

If the last release of a document viewer is during JS GC, it causes a JS
assertion because the call to SetStatus and SetDefaultStatus from
GlobalWindowImpl::SetNewDocument leads to a call to js_AllocGCThing.  This also
shouldn't be happening during destruction, since the JS GC could hold the
document viewer well past when the new document is displayed.  We're changing JS
code soon to clear up the tinderbox orange resulting from this...

Perhaps these calls should be moved into DocumentViewerImpl::Stop (from
GlobalWindowImpl::SetNewDocument)?

Comment 1

[Peter "jag" Annema]

Attachment: [patch] Work-around till this is fixed

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

r=dbaron

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: proposed fix

Comment 4

[Peter "jag" Annema]

r=jag

Comment 5

[Brendan Eich [:brendan]]

sr=[e-mail]

And someone needs to fix nsDocumentViewer.cpp so its dtor does not assume where
and when the last Release is called.

/be

Comment 6

[Peter "jag" Annema]

dbaron checked this patch in. More to follow?

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

See patch in bug 61821 for more (regarding brendan's comments).

Comment 8

[Johnny Stenback (:jst)]

I believe this is fixed by dbarons checkin, marking FIXED.

Comment 9

[Prashant Desale]

Verified with 2001-020608.