683885 - Assertion failure: self, at dom/workers/EventTarget.cpp:170 | Crash [@ mozilla::dom::workers::events::ListenerManager::RemoveEventListener(JSContext*, JSString*, unsigned __int64, bool) ]

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Bob Clary [:bc] (inactive)]

1. http://optimus.usatoday.com/ 	
2. wait for the local storage and get location prompts

Assertion failure: self, at /work/mozilla/builds/nightly/mozilla/dom/workers/EventTarget.cpp:170

Aurora/Nightly on Mac/Windows at least.

#0  0x06e87d73 in CrashInJS () at /work/mozilla/builds/nightly/mozilla/js/src/jsutil.cpp:92
#1  0x06e87ddd in JS_Assert (s=0x71a5892 "self", file=0x715d4f8 "/work/mozilla/builds/nightly/mozilla/dom/workers/EventTarget.cpp", ln=170) at /work/mozilla/builds/nightly/mozilla/js/src/jsutil.cpp:103
#2  0x05b65d79 in mozilla::dom::workers::events::EventTarget::RemoveEventListener (aCx=0x23e1c4f0, aArgc=3, aVp=0x1a6d40c8) at /work/mozilla/builds/nightly/mozilla/dom/workers/EventTarget.cpp:170
#3  0x06feef04 in js::CallJSNative (cx=0x23e1c4f0, native=0x5b65d24 <mozilla::dom::workers::events::EventTarget::RemoveEventListener(JSContext*, unsigned int, jsval_layout*)>, args=@0xbfffbd00) at jscntxtinlines.h:300
#4  0x06da2589 in js::InvokeKernel (cx=0x23e1c4f0, argsRef=@0xbfffc16c, construct=js::NO_CONSTRUCT) at jsinterp.cpp:671
#5  0x06d8e59d in js::Interpret (cx=0x23e1c4f0, entryFrame=0x1a6d4040, interpMode=js::JSINTERP_NORMAL) at /work/mozilla/builds/nightly/mozilla/js/src/jsinterp.cpp:4199
#6  0x06da1d31 in js::RunScript (cx=0x23e1c4f0, script=0x9b1e00, fp=0x1a6d4040) at jsinterp.cpp:623
#7  0x06da2792 in js::InvokeKernel (cx=0x23e1c4f0, argsRef=@0xbfffcc70, construct=js::NO_CONSTRUCT) at jsinterp.cpp:705
#8  0x06d37f52 in js::Invoke (cx=0x23e1c4f0, args=@0xbfffcc70, construct=js::NO_CONSTRUCT) at jsinterp.h:168

Comment 1

[Bob Clary [:bc] (inactive)]

winxp nightly bp-6da8cdfc-4713-4b1a-bf80-ffb5a2110901

[@ mozilla::dom::workers::events::ListenerManager::RemoveEventListener(JSContext*, JSString*, unsigned __int64, bool) ]

Comment 2

[Ben Turner (not reading bugmail, use the needinfo flag!)]

The problem is this:

  b.terminate();
  b.removeEventListener("message", e, false)

Need to think about how to fix it.

Comment 3

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Attachment: Patch, v1

This does what we discussed.

Comment 4

[Ben Turner (not reading bugmail, use the needinfo flag!)]

http://hg.mozilla.org/integration/mozilla-inbound/rev/c5a9a439d72c

Comment 5

[(no longer active)]

Backed out as part of <http://hg.mozilla.org/integration/mozilla-inbound/rev/cc0753a23f8b> because of mochitest-3 crashes like this: <https://tbpl.mozilla.org/php/getParsedLog.php?id=6340142&full=1>

Comment 6

[Ben Turner (not reading bugmail, use the needinfo flag!)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5f7dd649a521

Changes are over-the-shoulder-r+ from sicking.

Comment 7

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

https://hg.mozilla.org/mozilla-central/rev/5f7dd649a521

Comment 8

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

We want this on aurora and beta too, right?

Comment 9

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Yes.

Comment 10

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Comment on attachment 557579 [details] [diff] [review]
Patch, v1

This is another simple fix that corrects a crash in the new worker code. Has tests too.

Comment 11

[Ben Turner (not reading bugmail, use the needinfo flag!)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/76061bf73667
https://hg.mozilla.org/releases/mozilla-beta/rev/0cd309581778

Comment 12

[u279076]

Is the test for verification to check Error Console for the assertion when visiting the site in comment 0?

Comment 13

[Bob Clary [:bc] (inactive)]

ashughes: you need a debug build which will terminate if the fatal assertion fires.

Comment 14

[u279076]

qa- based on comment 13 -- if someone is setup with a debug build, please verify this fix. Thanks.

Comment 15

[Bob Clary [:bc] (inactive)]

Tested with debug builds on 1.9.2, Beta/8, Aurora/9, Nightly/10 on Windows XP, Windows 7, Mac OS X 10.5/6, Linux got one crash in 1.9.2 Windows 7 @ nsDOMWorker::Lock() nsDOMWorkerXHR::Lock() nsDOMWorkerXHRProxy::DestroyInternal() nsDOMWorkerXHRProxy::Run() nsThread::ProcessNextEvent(int, int*) 	

I checked with a nightly Nightly on Mac OS X 10.5, and Beta, Aurora and Nightly on Windows XP and didn't crash.

ashughes: from comment 1 this also crashed nightly builds, so you could also check that.