678818 - "ASSERTION: Window still registered with device motion" and crash

Status: RESOLVED FIXED

(Core :: DOM: Events, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox after closed)

Steps to reproduce:
1. Load the testcase.
2. Quit Firefox. (Or, close the tab and click the MP button in about:memory.)

Result: 

An assertion fails during GC:

###!!! ASSERTION: Window still registered with device motion.: '!mHasDeviceMotion', file dom/base/nsGlobalWindow.cpp, line 1039

Which is soon followed by:

Invalid read of freed memory [@ nsDeviceMotion::DeviceMotionChanged] in order to make a virtual function call.

(Beware: bp-4cdef108-d00e-4b39-8e21-d86152110813 makes it look like a null deref, but it is actually a more serious bug.)

Comment 1

[Jesse Ruderman]

Attachment: stack traces

Comment 2

[Doug Turner (:dougt)]

Attachment: patch v.1

We are starting up the device motion after Cleanup() is called.  This patch ensure that the device motion is disabled during the global window destructor.

Comment 3

[Doug Turner (:dougt)]

http://hg.mozilla.org/integration/mozilla-inbound/rev/1ac35ad29f03

Comment 4

[Doug Turner (:dougt)]

http://hg.mozilla.org/mozilla-central/rev/1ac35ad29f03

Comment 5

[Christopher Blizzard (:blizzard)]

Comment on attachment 553001 [details] [diff] [review]
patch v.1

Approved for Aurora (Update 8) and Beta (Update 7.) Please land it as soon as possible.

Comment 6

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

http://hg.mozilla.org/releases/mozilla-aurora/rev/f717ca3b24e7

This patch doesn't apply to beta ...

Comment 7

[Johnny Stenback (:jst)]

Doug, can you merge this fix to beta? Probably some silly context differences that causes it not to apply... And we're running out of time for 7...

Comment 8

[Doug Turner (:dougt)]

http://hg.mozilla.org/releases/mozilla-beta/rev/69750db9e4fa

Comment 9

[u279076]

qa- as no QA fix verification needed