678984 - Assertion failure: rt->onOwnerThread() running test_imapPasswordFailure.js

Status: RESOLVED FIXED

(MailNews Core :: Networking: IMAP, defect)

Description

[Mark Banner (:standard8)]

Following bug 650411, test_imapPasswordFailing.js is failing with:

Assertion failure: rt->onOwnerThread(), at /buildbot/linux-comm-central-build/build/mozilla/js/src/jsapi.cpp:6199
<<<<<<<
PROCESS-CRASH | /buildbot/comm-central-linux-opt-unittest-xpcshell/build/xpcshell/tests/mailnews/imap/test/unit/test_imapPasswordFailure.js | application crashed (minidump found)
Crash dump filename: /buildbot/comm-central-linux-opt-unittest-xpcshell/build/xpcshell/tests/mailnews/imap/test/unit/135fa0c0-eae0-1078-1dd03bd2-532c4d37.dmp
Operating system: Linux
                  0.0.0 Linux 2.6.31.5-127.fc12.i686.PAE #1 SMP Sat Nov 7 21:25:57 EST 2009 i686
CPU: x86
     GenuineIntel family 6 model 44 stepping 2
     1 CPU

Crash reason:  SIGABRT
Crash address: 0x5198

Thread 9 (crashed)
 0  linux-gate.so + 0x424
    eip = 0x007ae424   esp = 0xb15f4a60   ebp = 0xb15f4a78   ebx = 0x00005198
    esi = 0xb6c00548   edi = 0x0054aff4   eax = 0x00000000   ecx = 0x000051a1
    edx = 0x00000006   efl = 0x00000202
    Found by: given as instruction pointer in context
 1  libxul.so!CrashInJS [jsutil.cpp:e32b302039ca : 95 + 0xb]
    eip = 0x01e93cab   esp = 0xb15f4a80   ebp = 0x00000000
    Found by: previous frame's frame pointer
 2  libxul.so!JS_AbortIfWrongThread [jsapi.cpp:e32b302039ca : 6199 + 0x1f]
    eip = 0x01d5daef   esp = 0xb15f4aa0   ebp = 0x00000000   ebx = 0x0234403c
    Found by: call frame info
 3  libxul.so!js_NewContext [jscntxt.cpp:e32b302039ca : 319 + 0x7]
    eip = 0x01d7c990   esp = 0xb15f4ac0   ebp = 0x00000000   ebx = 0x0234403c
    Found by: call frame info
 4  libxul.so!XPCJSContextStack::GetSafeJSContext [xpcthreadcontext.cpp:e32b302039ca : 252 + 0xc]
    eip = 0x015f6d0e   esp = 0xb15f4b00   ebp = 0xb6c0f0d8   ebx = 0x0234403c
    esi = 0xb6c00548   edi = 0x09b7ca18
    Found by: call frame info
 5  libxul.so!XPCCallContext::Init [xpccallcontext.cpp:e32b302039ca : 132 + 0xb]
    eip = 0x015dd6a2   esp = 0xb15f4b60   ebp = 0x00000000   ebx = 0x0234403c
    esi = 0xb15f4c10   edi = 0xb6c00548
    Found by: call frame info
 6  libxul.so!XPCCallContext::XPCCallContext [xpccallcontext.cpp:e32b302039ca : 63 + 0x2b]
    eip = 0x015dd960   esp = 0xb15f4ba0   ebp = 0xb15f4c10   ebx = 0x0234403c
    esi = 0xb15f4c10   edi = 0x00000002
    Found by: call frame info
 7  libxul.so!GetContextFromObject [xpcwrappedjsclass.cpp:e32b302039ca : 566 + 0x19]
    eip = 0x015fa254   esp = 0xb15f4be0   ebp = 0xb15f4c10   ebx = 0x0234403c
    esi = 0x00000000   edi = 0xb2c513a0
    Found by: call frame info
 8  libxul.so!nsXPCWrappedJSClass::DelegatedQueryInterface [xpcwrappedjsclass.cpp:e32b302039ca : 689 + 0x7]
    eip = 0x015fb63a   esp = 0xb15f4cc0   ebp = 0x021e1a70   ebx = 0x0234403c
    esi = 0x09dcaf60   edi = 0xb15f4e4c
    Found by: call frame info
 9  libxul.so!nsXPCWrappedJS::QueryInterface [xpcwrappedjs.cpp:e32b302039ca : 161 + 0xb]
    eip = 0x015f7ef8   esp = 0xb15f4dc0   ebp = 0x021e1a70   ebx = 0x0234403c
    esi = 0x09dcaf60   edi = 0xb15f4e4c
    Found by: call frame info
10  libxul.so!nsWeakReference::QueryReferent [nsWeakReference.cpp:2f4de0b727c8 : 151 + 0x1d]
    eip = 0x0193d57f   esp = 0xb15f4e00   ebp = 0xb15f4e7c   ebx = 0x0234403c
    esi = 0xb15f4e70   edi = 0xb15f4e4c
    Found by: call frame info
11  libxul.so!nsQueryReferent::operator() [nsWeakReference.cpp:2f4de0b727c8 : 88 + 0x8]
    eip = 0x0193d63c   esp = 0xb15f4e20   ebp = 0xb15f4e7c   ebx = 0x0234403c
    esi = 0xb15f4e70   edi = 0xb15f4e4c
    Found by: call frame info
12  libxul.so!nsCOMPtr_base::assign_from_helper [nsCOMPtr.cpp:2f4de0b727c8 : 150 + 0x5]
    eip = 0x0193ba5b   esp = 0xb15f4e40   ebp = 0xb15f4e7c   ebx = 0x0234403c
    esi = 0x023160d8   edi = 0xb15f4e7c
    Found by: call frame info
13  libxul.so!nsMsgMailNewsUrl::GetMsgWindow [nsMsgMailNewsUrl.cpp:2f4de0b727c8 : 217 + 0x10]
    eip = 0x01cc0c6a   esp = 0xb15f4e60   ebp = 0xb15f4e7c   ebx = 0x0234403c
    esi = 0x80004003   edi = 0xb15f4fbc
    Found by: call frame info
14  libxul.so!nsImapProtocol::GetMsgWindow [nsImapProtocol.cpp:2f4de0b727c8 : 8159 + 0xe]
    eip = 0x01c14d94   esp = 0xb15f4ea0   ebp = 0x00000000   ebx = 0x0234403c
    esi = 0x00000000   edi = 0x00000000
    Found by: call frame info
15  libxul.so!nsImapProtocol::TryToLogon [nsImapProtocol.cpp:2f4de0b727c8 : 8397 + 0x18]
    eip = 0x01c1cd4c   esp = 0xb15f4ed0   ebp = 0x00000000   ebx = 0x0234403c
    esi = 0x09b8b4d0   edi = 0x00000000
    Found by: call frame info

It looks like the issue is that nsMsgMailNewsUrl is threadsafe, but is calling do_QueryReferent on its weak member which calls into js and hence is non-threadsafe.

Comment 1

[David :Bienvenu]

Attachment: proposed fix

proxy the getting of the msg window to the UI thread. This is temporary since this will all go away when xpcom proxies go away...

Comment 2

[Mark Banner (:standard8)]

Comment on attachment 553188 [details] [diff] [review]
proposed fix

Please bump the uuid on nsIImapProtocolSink, r=Standard8 with that fixed.

Comment 3

[David :Bienvenu]

http://hg.mozilla.org/comm-central/rev/66d6cc55d0e3

the sink idls are not used by extensions, so bumping the uuid is not useful, but I've done so.