631359 - Failed assertions in content/test/reftest/xml-stylesheet reftests and content/xslt crashtests (with out-of-process content)

Status: RESOLVED FIXED

(Core :: XML, defect)

Description

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

REFTEST TEST-UNEXPECTED-FAIL | file:///home/cjones/mozilla/mozilla-central/content/test/reftest/xml-stylesheet/embedded_dtd_id.svg | assertion count 1 is more than expected 0 assertions
REFTEST TEST-UNEXPECTED-FAIL | file:///home/cjones/mozilla/mozilla-central/content/test/reftest/xml-stylesheet/lreas_selflink_dtd_id.svg | assertion count 1 is more than expected 0 assertions
REFTEST TEST-UNEXPECTED-FAIL | file:///home/cjones/mozilla/mozilla-central/content/test/reftest/xml-stylesheet/lreas_selflink_empty_href.svg | assertion count 1 is more than expected 0 assertions
REFTEST TEST-UNEXPECTED-FAIL | file:///home/cjones/mozilla/mozilla-central/content/test/reftest/xml-stylesheet/lreas_selflink_relative_href.svg | assertion count 1 is more than expected 0 assertions
REFTEST TEST-UNEXPECTED-FAIL | file:///home/cjones/mozilla/mozilla-central/content/test/reftest/xml-stylesheet/xslt_relative_href.svg | assertion count 1 is more than expected 0 assertions
REFTEST TEST-UNEXPECTED-FAIL | file:///home/cjones/mozilla/mozilla-central/content/test/reftest/xml-stylesheet/xslt_selflink_dtd_id.xml | assertion count 1 is more than expected 0 assertions
REFTEST TEST-UNEXPECTED-FAIL | file:///home/cjones/mozilla/mozilla-central/content/test/reftest/xml-stylesheet/xslt_selflink_empty_href.xml | assertion count 1 is more than expected 0 assertions
REFTEST TEST-UNEXPECTED-FAIL | file:///home/cjones/mozilla/mozilla-central/content/test/reftest/xml-stylesheet/xslt_selflink_relative_href.xml | assertion count 1 is more than expected 0 assertions

The assertion failing is

###!!! ASSERTION: This will screw up our existing presentation: '!mPresShell && !mWindow', file /home/cjones/mozilla/mozilla-central/layout/base/nsDocumentViewer.cpp, line 2400
DocumentViewerImpl::CreateDeviceContext(nsIView*) (/home/cjones/mozilla/mozilla-central/layout/base/nsDocumentViewer.cpp:2401)
DocumentViewerImpl::InitInternal(nsIWidget*, nsISupports*, nsIntRect const&, int, int, int) (/home/cjones/mozilla/mozilla-central/layout/base/nsDocumentViewer.cpp:864)
DocumentViewerImpl::SetDocumentInternal(nsIDocument*, int) (/home/cjones/mozilla/mozilla-central/layout/base/nsDocumentViewer.cpp:1758)
nsXMLContentSink::OnDocumentCreated(nsIDocument*) (/home/cjones/mozilla/mozilla-central/content/xml/document/src/nsXMLContentSink.cpp:385)
txTransformNotifier::SetOutputDocument(nsIDocument*) (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txMozillaXMLOutput.cpp:1089)
txMozillaXMLOutput::createResultDocument(nsAString_internal const&, int, nsIDOMDocument*, nsIDOMDocument*) (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txMozillaXMLOutput.cpp:923)
txMozillaXMLOutput (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txMozillaXMLOutput.cpp:109)
txToDocHandlerFactory::createHandlerWith(txOutputFormat*, nsAString_internal const&, int, txAXMLEventHandler**) (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp:168)
txUnknownHandler::createHandlerAndFlush(int, nsAString_internal const&, int) (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txUnknownHandler.cpp:159)
txUnknownHandler::startElement(nsIAtom*, nsIAtom*, nsIAtom*, int) (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txUnknownHandler.cpp:110)
txStartLREElement::execute(txExecutionState&) (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txInstructions.cpp:931)
txXSLTProcessor::execute(txExecutionState&) (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txXSLTProcessor.cpp:104)
txMozillaXSLTProcessor::TransformToDoc(nsIDOMDocument*, nsIDOMDocument**) (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp:690)
nsTransformBlockerEvent::Run() (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp:571)
nsThread::ProcessNextEvent(int, int*) (/home/cjones/mozilla/mozilla-central/xpcom/threads/nsThread.cpp:633)
NS_ProcessNextEvent_P(nsIThread*, int) (/home/cjones/mozilla/ff-dbg/xpcom/build/nsThreadUtils.cpp:250)
mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) (/home/cjones/mozilla/mozilla-central/ipc/glue/MessagePump.cpp:110)
mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) (/home/cjones/mozilla/mozilla-central/ipc/glue/MessagePump.cpp:230)
MessageLoop::RunInternal() (/home/cjones/mozilla/mozilla-central/ipc/chromium/src/base/message_loop.cc:220)
MessageLoop::RunHandler() (/home/cjones/mozilla/mozilla-central/ipc/chromium/src/base/message_loop.cc:203)
MessageLoop::Run() (/home/cjones/mozilla/mozilla-central/ipc/chromium/src/base/message_loop.cc:176)
nsBaseAppShell::Run() (/home/cjones/mozilla/mozilla-central/widget/src/xpwidgets/nsBaseAppShell.cpp:198)
XRE_RunAppShell (/home/cjones/mozilla/mozilla-central/toolkit/xre/nsEmbedFunctions.cpp:678)
mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) (/home/cjones/mozilla/mozilla-central/ipc/glue/MessagePump.cpp:215)
MessageLoop::RunInternal() (/home/cjones/mozilla/mozilla-central/ipc/chromium/src/base/message_loop.cc:220)
MessageLoop::RunHandler() (/home/cjones/mozilla/mozilla-central/ipc/chromium/src/base/message_loop.cc:203)
MessageLoop::Run() (/home/cjones/mozilla/mozilla-central/ipc/chromium/src/base/message_loop.cc:176)
XRE_InitChildProcess (/home/cjones/mozilla/mozilla-central/toolkit/xre/nsEmbedFunctions.cpp:519)
main (/home/cjones/mozilla/mozilla-central/ipc/app/MozillaRuntimeMain.cpp:80)
__libc_start_main (/build/buildd/eglibc-2.12.1/csu/libc-start.c:258)
_start (/home/cjones/mozilla/ff-dbg/dist/bin/plugin-container)


This is a relatively recent (within the last ~month) regression.

Comment 1

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Also failing these crashtests

REFTEST TEST-UNEXPECTED-FAIL | file:///home/cjones/mozilla/mozilla-central/content/xslt/crashtests/91332.xml | assertion count 1 is more than expected 0 assertions
REFTEST TEST-UNEXPECTED-FAIL | file:///home/cjones/mozilla/mozilla-central/content/xslt/crashtests/111994.xml | assertion count 1 is more than expected 0 assertions
REFTEST TEST-UNEXPECTED-FAIL | file:///home/cjones/mozilla/mozilla-central/content/xslt/crashtests/226425.xml | assertion count 1 is more than expected 0 assertions
REFTEST TEST-UNEXPECTED-FAIL | file:///home/cjones/mozilla/mozilla-central/content/xslt/crashtests/483444.xml | assertion count 1 is more than expected 0 assertions
REFTEST TEST-UNEXPECTED-FAIL | file:///home/cjones/mozilla/mozilla-central/content/xslt/crashtests/485217.xml | assertion count 1 is more than expected 0 assertions
REFTEST TEST-UNEXPECTED-FAIL | file:///home/cjones/mozilla/mozilla-central/content/xslt/crashtests/485286.xml | assertion count 1 is more than expected 0 assertions
REFTEST TEST-UNEXPECTED-FAIL | file:///home/cjones/mozilla/mozilla-central/content/xslt/crashtests/528300.xml | assertion count 1 is more than expected 0 assertions
REFTEST TEST-UNEXPECTED-FAIL | file:///home/cjones/mozilla/mozilla-central/content/xslt/crashtests/528488.xml | assertion count 1 is more than expected 0 assertions
REFTEST TEST-UNEXPECTED-FAIL | file:///home/cjones/mozilla/mozilla-central/content/xslt/crashtests/528963.xml | assertion count 1 is more than expected 0 assertions

~Same assertion

###!!! ASSERTION: This will screw up our existing presentation: '!mPresShell && !mWindow', file /home/cjones/mozilla/mozilla-central/layout/base/nsDocumentViewer.cpp, line 2400
DocumentViewerImpl::CreateDeviceContext(nsIView*) (/home/cjones/mozilla/mozilla-central/layout/base/nsDocumentViewer.cpp:2401)
DocumentViewerImpl::InitInternal(nsIWidget*, nsISupports*, nsIntRect const&, int, int, int) (/home/cjones/mozilla/mozilla-central/layout/base/nsDocumentViewer.cpp:864)
DocumentViewerImpl::SetDocumentInternal(nsIDocument*, int) (/home/cjones/mozilla/mozilla-central/layout/base/nsDocumentViewer.cpp:1758)
nsXMLContentSink::OnDocumentCreated(nsIDocument*) (/home/cjones/mozilla/mozilla-central/content/xml/document/src/nsXMLContentSink.cpp:385)
txTransformNotifier::SetOutputDocument(nsIDocument*) (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txMozillaXMLOutput.cpp:1089)
txMozillaXMLOutput::createResultDocument(nsAString_internal const&, int, nsIDOMDocument*, nsIDOMDocument*) (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txMozillaXMLOutput.cpp:923)
txMozillaXMLOutput (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txMozillaXMLOutput.cpp:109)
txToDocHandlerFactory::createHandlerWith(txOutputFormat*, nsAString_internal const&, int, txAXMLEventHandler**) (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp:168)
txUnknownHandler::createHandlerAndFlush(int, nsAString_internal const&, int) (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txUnknownHandler.cpp:159)
txUnknownHandler::startElement(nsIAtom*, nsAString_internal const&, int) (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txUnknownHandler.cpp:134)
txStartElement::execute(txExecutionState&) (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txInstructions.cpp:893)
txXSLTProcessor::execute(txExecutionState&) (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txXSLTProcessor.cpp:104)
txMozillaXSLTProcessor::TransformToDoc(nsIDOMDocument*, nsIDOMDocument**) (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp:690)
nsTransformBlockerEvent::Run() (/home/cjones/mozilla/mozilla-central/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp:571)

Comment 2

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

I see that this assertion was added by bug 433616.  Imploring guidance from its author.

I'm looking at http://mxr.mozilla.org/mozilla-central/source/content/xslt/crashtests/91332.xml for a simple case (hell, I'll just inline it)

<?xml version="1.0" standalone="yes" ?>
<?xml-stylesheet type="text/xsl" href="91332.xsl" ?>
<root>
  <category name="Rectangles">
    <list item="square" />
  </category>
  <quad id="square">
    <desc>A square is ...</desc>
  </quad>
</root>

I set breakpoints at the widget-creation path in DocumentViewerImpl::MakeWindow (http://mxr.mozilla.org/mozilla-central/source/layout/base/nsDocumentViewer.cpp#2304) and the assertion failing above.  Here's what happens in gdb

 - hit MakeWindow(this=0x23fab30) breakpoint below nsDocShell::CreateAboutBlankContentViewer.  OK, expected.
 - hit MakeWindow(this=0x284d1f0) breakpoint below nsDocShell::CreateContentViewer.  OK.
 - hit MakeWindow(this=0x28362b0) breakpoint below nsDocShell::CreateContentViewer.  Hm.
 - hit failing CreateDeviceContext(this=0x28362b0) assertion below txMozillaXMLOutput::createResultDocument.
 - hit MakeWindow(this=0x28362b0) breakpoint below txMozillaXMLOutput::createResultDocument.
 - hit MakeWindow(this=0x28c9e30) breakpoint below CreateContentViewer.  Hmm

I'm not exactly sure what's supposed to happen, but surely not all those should be creating a widget.  Note too that the create-widget path in MakeWindow is protected by mDocument->IsResourceDoc().  I suspect the way things are set up in the content process is violating assumptions somewhere.

bz, what's supposed to happen here?  I'm more than happy to find and fix whatever this bug is, but I'm not sure what things are supposed to look like :).

Comment 3

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

I should also add that the file eventually displays just fine in the <browser remote>, same as in single-process FF.  If the cost of fixing this outweighs the benefit of getting reftest/crashtest-ipc enabled sooner, I'll just |asserts-if(gBrowserIsRemote, 1)| these tests.

Comment 4

[Boris Zbarsky [:bzbarsky]]

> - hit MakeWindow(this=0x28362b0) breakpoint below
> nsDocShell::CreateContentViewer.  Hm.
> - hit failing CreateDeviceContext(this=0x28362b0) assertion below
> txMozillaXMLOutput::createResultDocument.

Looks like a likely regression from bug 581536.  Wasn't biting firefox, presumably, because there is no mWindow there for content frames or something, right?

I _think_, though roc should confirm, that the right fix is to null out mWindow right before the InitInternal call in SetDocumentInternal.

Comment 5

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Boris, are you OK with an asserts-if() band-aid for the time being?

Comment 6

[Boris Zbarsky [:bzbarsky]]

I think so, yes, if it's making trees orange.

Comment 7

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

There are no trees to make orange, sadly, which is the problem I'm trying to fix with the dep bugs.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Oh, I see.  If this is blocking progress right now, then sure.  I fully expect roc to comment here Sunday afternoon US time, and for us to land a fix on Monday, fwiw.

Comment 9

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

http://hg.mozilla.org/mozilla-central/rev/88f322876de1