Closed Bug 683885 Opened 9 years ago Closed 8 years ago

Assertion failure: self, at dom/workers/EventTarget.cpp:170 | Crash [@ mozilla::dom::workers::events::ListenerManager::RemoveEventListener(JSContext*, JSString*, unsigned __int64, bool) ]

Categories

(Core :: DOM: Core & HTML, defect, critical)

x86
All
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla10
Tracking Status
firefox8 --- fixed
firefox9 --- fixed

People

(Reporter: bc, Assigned: bent.mozilla)

References

(Blocks 1 open bug, )

Details

(4 keywords, Whiteboard: [qa-])

Crash Data

Attachments

(1 file)

1. http://optimus.usatoday.com/ 	
2. wait for the local storage and get location prompts

Assertion failure: self, at /work/mozilla/builds/nightly/mozilla/dom/workers/EventTarget.cpp:170

Aurora/Nightly on Mac/Windows at least.

#0  0x06e87d73 in CrashInJS () at /work/mozilla/builds/nightly/mozilla/js/src/jsutil.cpp:92
#1  0x06e87ddd in JS_Assert (s=0x71a5892 "self", file=0x715d4f8 "/work/mozilla/builds/nightly/mozilla/dom/workers/EventTarget.cpp", ln=170) at /work/mozilla/builds/nightly/mozilla/js/src/jsutil.cpp:103
#2  0x05b65d79 in mozilla::dom::workers::events::EventTarget::RemoveEventListener (aCx=0x23e1c4f0, aArgc=3, aVp=0x1a6d40c8) at /work/mozilla/builds/nightly/mozilla/dom/workers/EventTarget.cpp:170
#3  0x06feef04 in js::CallJSNative (cx=0x23e1c4f0, native=0x5b65d24 <mozilla::dom::workers::events::EventTarget::RemoveEventListener(JSContext*, unsigned int, jsval_layout*)>, args=@0xbfffbd00) at jscntxtinlines.h:300
#4  0x06da2589 in js::InvokeKernel (cx=0x23e1c4f0, argsRef=@0xbfffc16c, construct=js::NO_CONSTRUCT) at jsinterp.cpp:671
#5  0x06d8e59d in js::Interpret (cx=0x23e1c4f0, entryFrame=0x1a6d4040, interpMode=js::JSINTERP_NORMAL) at /work/mozilla/builds/nightly/mozilla/js/src/jsinterp.cpp:4199
#6  0x06da1d31 in js::RunScript (cx=0x23e1c4f0, script=0x9b1e00, fp=0x1a6d4040) at jsinterp.cpp:623
#7  0x06da2792 in js::InvokeKernel (cx=0x23e1c4f0, argsRef=@0xbfffcc70, construct=js::NO_CONSTRUCT) at jsinterp.cpp:705
#8  0x06d37f52 in js::Invoke (cx=0x23e1c4f0, args=@0xbfffcc70, construct=js::NO_CONSTRUCT) at jsinterp.h:168
winxp nightly bp-6da8cdfc-4713-4b1a-bf80-ffb5a2110901

[@ mozilla::dom::workers::events::ListenerManager::RemoveEventListener(JSContext*, JSString*, unsigned __int64, bool) ]
Crash Signature: [@ mozilla::dom::workers::events::ListenerManager::RemoveEventListener(JSContext*, JSString*, unsigned __int64, bool) ]
Keywords: crash
Summary: Assertion failure: self, at dom/workers/EventTarget.cpp:170 → Assertion failure: self, at dom/workers/EventTarget.cpp:170 | Crash [@ mozilla::dom::workers::events::ListenerManager::RemoveEventListener(JSContext*, JSString*, unsigned __int64, bool) ]
The problem is this:

  b.terminate();
  b.removeEventListener("message", e, false)

Need to think about how to fix it.
Assignee: nobody → bent.mozilla
Status: NEW → ASSIGNED
Attached patch Patch, v1Splinter Review
This does what we discussed.
Attachment #557579 - Flags: review?(jonas)
Backed out as part of <http://hg.mozilla.org/integration/mozilla-inbound/rev/cc0753a23f8b> because of mochitest-3 crashes like this: <https://tbpl.mozilla.org/php/getParsedLog.php?id=6340142&full=1>
Whiteboard: [inbound]
https://hg.mozilla.org/integration/mozilla-inbound/rev/5f7dd649a521

Changes are over-the-shoulder-r+ from sicking.
Whiteboard: [inbound]
https://hg.mozilla.org/mozilla-central/rev/5f7dd649a521
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla10
We want this on aurora and beta too, right?
Comment on attachment 557579 [details] [diff] [review]
Patch, v1

This is another simple fix that corrects a crash in the new worker code. Has tests too.
Attachment #557579 - Flags: approval-mozilla-beta?
Attachment #557579 - Flags: approval-mozilla-aurora?
Attachment #557579 - Flags: approval-mozilla-beta?
Attachment #557579 - Flags: approval-mozilla-beta+
Attachment #557579 - Flags: approval-mozilla-aurora?
Attachment #557579 - Flags: approval-mozilla-aurora+
Is the test for verification to check Error Console for the assertion when visiting the site in comment 0?
Whiteboard: [qa?]
ashughes: you need a debug build which will terminate if the fatal assertion fires.
qa- based on comment 13 -- if someone is setup with a debug build, please verify this fix. Thanks.
Whiteboard: [qa?] → [qa-]
Tested with debug builds on 1.9.2, Beta/8, Aurora/9, Nightly/10 on Windows XP, Windows 7, Mac OS X 10.5/6, Linux got one crash in 1.9.2 Windows 7 @ nsDOMWorker::Lock() nsDOMWorkerXHR::Lock() nsDOMWorkerXHRProxy::DestroyInternal() nsDOMWorkerXHRProxy::Run() nsThread::ProcessNextEvent(int, int*) 	

I checked with a nightly Nightly on Mac OS X 10.5, and Beta, Aurora and Nightly on Windows XP and didn't crash.

ashughes: from comment 1 this also crashed nightly builds, so you could also check that.
Status: RESOLVED → VERIFIED
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.