691255 - "attempt to run compile-and-go script on a cleared scope" in aboutSessionRestore.js

Status: NEW

(Firefox :: Session Restore, defect)

Description

[Richard Newman [:rnewman]]

************************************************************
* Call to xpconnect wrapped JSObject produced this error:  *
[Exception... "'[JavaScript Error: "attempt to run compile-and-go script on a cleared scope" {file: "chrome://browser/content/aboutSessionRestore.js" line: 277}]' when calling method: [nsITreeView::setTree]"  nsresult: "0x80570021 (NS_ERROR_XPC_JAVASCRIPT_ERROR_WITH_DETAILS)"  location: "native frame :: <unknown filename> :: <TOP_LEVEL> :: line 0"  data: yes]
************************************************************

Comment 1

[Paul O'Shannessy [:zpao] (not bugmail, email directly)]

Was this just during a restore following a crash or was about:sessionrestore opened under other some other condition (tests maybe)?

That's not new and I think Brendan said at some point that this is bug 635548 and is actually harmless and can be ignored. But it's been a few months

Comment 2

[Richard Newman [:rnewman]]

This was a test profile relaunch after either a quit or a Ctrl-C in the controlling terminal. Sometimes either of those will cause an "oops" session restore to appear on relaunch.

I didn't open about:sessionrestore manually.

Comment 3

[Paul O'Shannessy [:zpao] (not bugmail, email directly)]

dbaron mentioned this in bug 614335 - it has to do with the treeview, specifically treeview.setTree.

I did some more investigation today and it only happens when we overwrite the state of the about:sessionrestore tab. We do that by deleting all the sessionhistory, so maybe we're not triggering teardown code for the tree?

Neil, do you have any ideas what might be happening here? setTree is getting called after the treeview no longer exists presumably. I tried adding dump()s in setTree, but it's only called with BoxObjects, so maybe those failing calls aren't even getting into the body?

If you need to repro, run the b-c mochitest browser/components/sessionstore/test/browser/browser_467409-backslashplosion.js (take out the ignoreAllUncaughtExceptions() line to make sure the exceptions are reported).

Comment 4

[Paul O'Shannessy [:zpao] (not bugmail, email directly)]

Attachment: backtrace

This is from a breakpoint set where the cleared scope error comes from.

nsTreeBoxObject::Clear is on the stack (at mView->SetTree(nsnull)) so I think my theory is substantiated.

Comment 5

[Neil Deakin]

The treeview still exists at that point. The error occurs while trying to clear it out and uninitialize/destroy the box object.

I'm assuming that this is the session restore page (that displays the tree of pages to restore) being unloaded and replaced with some page to restore. Presumably, the error occurs because the window scope has already been disconnected.

Currently box objects are removed near the end of nsDocument's destructor, but perhaps the box objects should be cleared earlier during Destroy. But I don't really know.