Last Comment Bug 683885 - Assertion failure: self, at dom/workers/EventTarget.cpp:170 | Crash [@ mozilla::dom::workers::events::ListenerManager::RemoveEventListener(JSContext*, JSString*, unsigned __int64, bool) ]
: Assertion failure: self, at dom/workers/EventTarget.cpp:170 | Crash [@ mozill...
Status: VERIFIED FIXED
[qa-]
: assertion, crash, verified-aurora, verified-beta
Product: Core
Classification: Components
Component: DOM (show other bugs)
: Trunk
: x86 All
: -- critical (vote)
: mozilla10
Assigned To: Ben Turner (not reading bugmail, use the needinfo flag!)
:
: Andrew Overholt [:overholt]
Mentors:
http://optimus.usatoday.com/
Depends on:
Blocks: 532972
  Show dependency treegraph
 
Reported: 2011-09-01 06:48 PDT by Bob Clary [:bc:]
Modified: 2011-10-13 12:55 PDT (History)
5 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
fixed
fixed


Attachments
Patch, v1 (7.65 KB, patch)
2011-09-01 11:19 PDT, Ben Turner (not reading bugmail, use the needinfo flag!)
jonas: review+
christian: approval‑mozilla‑aurora+
christian: approval‑mozilla‑beta+
Details | Diff | Splinter Review

Description Bob Clary [:bc:] 2011-09-01 06:48:22 PDT
1. http://optimus.usatoday.com/ 	
2. wait for the local storage and get location prompts

Assertion failure: self, at /work/mozilla/builds/nightly/mozilla/dom/workers/EventTarget.cpp:170

Aurora/Nightly on Mac/Windows at least.

#0  0x06e87d73 in CrashInJS () at /work/mozilla/builds/nightly/mozilla/js/src/jsutil.cpp:92
#1  0x06e87ddd in JS_Assert (s=0x71a5892 "self", file=0x715d4f8 "/work/mozilla/builds/nightly/mozilla/dom/workers/EventTarget.cpp", ln=170) at /work/mozilla/builds/nightly/mozilla/js/src/jsutil.cpp:103
#2  0x05b65d79 in mozilla::dom::workers::events::EventTarget::RemoveEventListener (aCx=0x23e1c4f0, aArgc=3, aVp=0x1a6d40c8) at /work/mozilla/builds/nightly/mozilla/dom/workers/EventTarget.cpp:170
#3  0x06feef04 in js::CallJSNative (cx=0x23e1c4f0, native=0x5b65d24 <mozilla::dom::workers::events::EventTarget::RemoveEventListener(JSContext*, unsigned int, jsval_layout*)>, args=@0xbfffbd00) at jscntxtinlines.h:300
#4  0x06da2589 in js::InvokeKernel (cx=0x23e1c4f0, argsRef=@0xbfffc16c, construct=js::NO_CONSTRUCT) at jsinterp.cpp:671
#5  0x06d8e59d in js::Interpret (cx=0x23e1c4f0, entryFrame=0x1a6d4040, interpMode=js::JSINTERP_NORMAL) at /work/mozilla/builds/nightly/mozilla/js/src/jsinterp.cpp:4199
#6  0x06da1d31 in js::RunScript (cx=0x23e1c4f0, script=0x9b1e00, fp=0x1a6d4040) at jsinterp.cpp:623
#7  0x06da2792 in js::InvokeKernel (cx=0x23e1c4f0, argsRef=@0xbfffcc70, construct=js::NO_CONSTRUCT) at jsinterp.cpp:705
#8  0x06d37f52 in js::Invoke (cx=0x23e1c4f0, args=@0xbfffcc70, construct=js::NO_CONSTRUCT) at jsinterp.h:168
Comment 1 Bob Clary [:bc:] 2011-09-01 07:11:55 PDT
winxp nightly bp-6da8cdfc-4713-4b1a-bf80-ffb5a2110901

[@ mozilla::dom::workers::events::ListenerManager::RemoveEventListener(JSContext*, JSString*, unsigned __int64, bool) ]
Comment 2 Ben Turner (not reading bugmail, use the needinfo flag!) 2011-09-01 09:07:21 PDT
The problem is this:

  b.terminate();
  b.removeEventListener("message", e, false)

Need to think about how to fix it.
Comment 3 Ben Turner (not reading bugmail, use the needinfo flag!) 2011-09-01 11:19:02 PDT
Created attachment 557579 [details] [diff] [review]
Patch, v1

This does what we discussed.
Comment 4 Ben Turner (not reading bugmail, use the needinfo flag!) 2011-09-08 17:27:44 PDT
http://hg.mozilla.org/integration/mozilla-inbound/rev/c5a9a439d72c
Comment 5 :Ehsan Akhgari 2011-09-08 19:06:38 PDT
Backed out as part of <http://hg.mozilla.org/integration/mozilla-inbound/rev/cc0753a23f8b> because of mochitest-3 crashes like this: <https://tbpl.mozilla.org/php/getParsedLog.php?id=6340142&full=1>
Comment 6 Ben Turner (not reading bugmail, use the needinfo flag!) 2011-10-07 15:52:20 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/5f7dd649a521

Changes are over-the-shoulder-r+ from sicking.
Comment 7 Kyle Huey [:khuey] (Exited; not receiving bugmail, email if necessary) 2011-10-09 07:34:38 PDT
https://hg.mozilla.org/mozilla-central/rev/5f7dd649a521
Comment 8 Kyle Huey [:khuey] (Exited; not receiving bugmail, email if necessary) 2011-10-09 07:35:18 PDT
We want this on aurora and beta too, right?
Comment 9 Ben Turner (not reading bugmail, use the needinfo flag!) 2011-10-09 19:25:05 PDT
Yes.
Comment 10 Ben Turner (not reading bugmail, use the needinfo flag!) 2011-10-09 19:25:56 PDT
Comment on attachment 557579 [details] [diff] [review]
Patch, v1

This is another simple fix that corrects a crash in the new worker code. Has tests too.
Comment 12 Anthony Hughes (:ashughes) [GFX][QA][Mentor] 2011-10-13 11:09:16 PDT
Is the test for verification to check Error Console for the assertion when visiting the site in comment 0?
Comment 13 Bob Clary [:bc:] 2011-10-13 11:11:51 PDT
ashughes: you need a debug build which will terminate if the fatal assertion fires.
Comment 14 Anthony Hughes (:ashughes) [GFX][QA][Mentor] 2011-10-13 11:48:34 PDT
qa- based on comment 13 -- if someone is setup with a debug build, please verify this fix. Thanks.
Comment 15 Bob Clary [:bc:] 2011-10-13 12:55:33 PDT
Tested with debug builds on 1.9.2, Beta/8, Aurora/9, Nightly/10 on Windows XP, Windows 7, Mac OS X 10.5/6, Linux got one crash in 1.9.2 Windows 7 @ nsDOMWorker::Lock() nsDOMWorkerXHR::Lock() nsDOMWorkerXHRProxy::DestroyInternal() nsDOMWorkerXHRProxy::Run() nsThread::ProcessNextEvent(int, int*) 	

I checked with a nightly Nightly on Mac OS X 10.5, and Beta, Aurora and Nightly on Windows XP and didn't crash.

ashughes: from comment 1 this also crashed nightly builds, so you could also check that.

Note You need to log in before you can comment on or make changes to this bug.