Last Comment Bug 625639 - "Assertion failure: !cx->isExceptionPending()" with setUserData, getter
: "Assertion failure: !cx->isExceptionPending()" with setUserData, getter
: assertion, testcase
Product: Core
Classification: Components
Component: XPConnect (show other bugs)
: Trunk
: x86 Mac OS X
-- critical (vote)
: mozilla10
Assigned To: Steve Fink [:sfink] [:s:]
: Andrew Overholt [:overholt]
Depends on:
Blocks: 326633
  Show dependency treegraph
Reported: 2011-01-13 19:11 PST by Jesse Ruderman
Modified: 2011-11-05 03:11 PDT (History)
8 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

testcase (188 bytes, text/html)
2011-01-13 19:11 PST, Jesse Ruderman
no flags Details
stack trace (256.79 KB, text/plain)
2011-01-13 19:11 PST, Jesse Ruderman
no flags Details
Fix XPCConvert error handling (1.83 KB, patch)
2011-10-24 14:01 PDT, Steve Fink [:sfink] [:s:]
mrbkap: review+
Details | Diff | Splinter Review

Description User image Jesse Ruderman 2011-01-13 19:11:24 PST
Created attachment 503720 [details]

Assertion failure: !cx->isExceptionPending(), at js/src/jscntxtinlines.h:695

The stack trace for the assertion is very long, but an opt build does not crash.
Comment 1 User image Jesse Ruderman 2011-01-13 19:11:38 PST
Created attachment 503721 [details]
stack trace
Comment 2 User image Jesse Ruderman 2011-10-23 22:36:39 PDT
Oh, I bet this is a bug involving JS_CHECK_RECURSION recovery.
Comment 3 User image Jesse Ruderman 2011-10-23 23:30:01 PDT
I think this bug is making it difficult to create reduced testcases for other JS_CHECK_RECURSION bugs, some of which may be more serious.
Comment 4 User image Steve Fink [:sfink] [:s:] 2011-10-24 14:01:33 PDT
Created attachment 569174 [details] [diff] [review]
Fix XPCConvert error handling

I don't know this code either, but the test case and assert seemed nice and straightforward so I took a quick look. The debugger pointed to code that seemed highly suspicious. This patch fixes the attached test case and seems better, at least, than what's there now. I may get lazy and mark this as checkin-needed, though.

The problem seems to be that there are at least half a dozen ways for XPCConvert::NativeInterface2JSObject to return false without setting the nsresult to an error value, because it gets whitewashed prematurely.
Comment 5 User image Blake Kaplan (:mrbkap) 2011-11-04 13:59:13 PDT
Comment on attachment 569174 [details] [diff] [review]
Fix XPCConvert error handling

Yep, my bad. Thanks for catching this.
Comment 6 User image Steve Fink [:sfink] [:s:] 2011-11-04 22:15:36 PDT
Comment 7 User image Marco Bonardo [::mak] 2011-11-05 03:11:47 PDT

Note You need to log in before you can comment on or make changes to this bug.