Closed Bug 738956 Opened 8 years ago Closed 8 years ago

test-page-mod.testHistory is triggering a compartment mismatch assertion in debug builds after the most recent inbound -> central merge

Categories

(Core :: DOM: Core & HTML, defect, P1, major)

defect

Tracking

()

VERIFIED FIXED
mozilla14

People

(Reporter: KWierso, Assigned: bholley)

References

Details

(Whiteboard: [triage:followup])

Attachments

(2 files)

info: executing 'test-page-mod.testHistory'
++DOCSHELL 0xd5d5270 == 28 [id = 437]
++DOMWINDOW == 143 (0xec99ba8) [serial = 1054] [outer = (nil)]
++DOMWINDOW == 144 (0xe8b9308) [serial = 1055] [outer = 0xec99b60]
WARNING: NS_ENSURE_TRUE(mMutable) failed: file ../../../../netwerk/base/src/nsSimpleURI.cpp, line 293
++DOMWINDOW == 145 (0xee1a438) [serial = 1056] [outer = 0xec99b60]
*** Compartment mismatch 0xa65b920 vs. 0xe7bd5a0
Assertion failure: compartment mismatched, at ../../../js/src/jscntxtinlines.h:156
Traceback (most recent call last):
  File "bin/cfx", line 33, in <module>
    cuddlefish.run()
  File "/home/cltbld/talos-slave/test/build/addon-sdk-3ce8a0112619/python-lib/cuddlefish/__init__.py", line 517, in run
    test_all(env_root, defaults=options.__dict__)
  File "/home/cltbld/talos-slave/test/build/addon-sdk-3ce8a0112619/python-lib/cuddlefish/__init__.py", line 345, in test_all
    test_all_packages(env_root, defaults)
  File "/home/cltbld/talos-slave/test/build/addon-sdk-3ce8a0112619/python-lib/cuddlefish/__init__.py", line 408, in test_all_packages
    env_root=env_root)
  File "/home/cltbld/talos-slave/test/build/addon-sdk-3ce8a0112619/python-lib/cuddlefish/__init__.py", line 785, in run
    mobile_app_name=options.mobile_app_name)
  File "/home/cltbld/talos-slave/test/build/addon-sdk-3ce8a0112619/python-lib/cuddlefish/runner.py", line 663, in run_app
    OUTPUT_TIMEOUT)
Exception: Test output exceeded timeout (60s).
program finished with exit code 1


All of the debug builds finished so far from this merge have been asserting a compartment mismatch while running the testHistory SDK test: https://tbpl.mozilla.org/?noignore=1&jobname=jetpack&rev=20a01901480f
Jetpack tests don't seem to run on Inbound, so I can't see what individual push caused this.

If I had to guess, I'd say bug 667388 or bug 733984 since they deal with wrappers. But since this test is dealing with history, maybe the SQLite upgrade in bug 737807 is doing something differently?
Attached file Stack
https://hg.mozilla.org/mozilla-central/pushloghtml?changeset=4c2c3a714ebe

Given that we assert under JSStructuredCloneWriter::startWrite, this looks like a regression from <https://hg.mozilla.org/mozilla-central/rev/1fb77c1bb742> (bug 667388). Bobby?
For reference, STR:

git clone git://github.com/mozilla/addon-sdk.git
cd addon-sdk
source bin/activate
cfx -b /obj/dist/bin/firefox --filter test-page-mod --no-run testpkgs

This prints something like

Testing addon-kit...
Using binary at '/obj/dist/bin/firefox'.
Using profile at '/tmp/tmpnZt9ZQ.mozrunner'.
To launch the application, enter the following command:
/obj/dist/bin/firefox -profile /tmp/tmpnZt9ZQ.mozrunner -no-remote

(note: pick the one that mentions 'addon-kit'). Run

gdb --args /obj/dist/bin/firefox -profile /tmp/tmpnZt9ZQ.mozrunner -no-remote
investigating.
Assignee: nobody → bobbyholley+bmo
Looks like I added the relevant assertSameCompartment, but the bug itself has been around for a while. Flagging jlebar for review, since it looks like he wrote the file.
Attachment #609195 - Flags: review?(justin.lebar+bug)
> Looks like I added the relevant assertSameCompartment, but the bug itself
> has been around for a while. Flagging jlebar for review, since it looks like
> he wrote the file.

I have no idea if this is right.  Can mrbkap review?
Attachment #609195 - Flags: review?(mrbkap)
Attachment #609195 - Flags: review?(justin.lebar+bug)
Attachment #609195 - Flags: feedback+
Comment on attachment 609195 [details] [diff] [review]
Wrap values in nsStructuredCloneContainer::InitFromVariant before passing them to JS_WriteStructuredClone. v1

Kyle is sitting next to me, and will take this review.
Attachment #609195 - Flags: review?(mrbkap) → review?(khuey)
Kyle, IIRC we decided this was ok given the circumstances (and various followups). Can you r+?
Comment on attachment 609195 [details] [diff] [review]
Wrap values in nsStructuredCloneContainer::InitFromVariant before passing them to JS_WriteStructuredClone. v1

Review of attachment 609195 [details] [diff] [review]:
-----------------------------------------------------------------

Assuming we need to enter the compartment, we need to do this.
Attachment #609195 - Flags: review?(khuey) → review+
Pushed to m-i:

http://hg.mozilla.org/integration/mozilla-inbound/rev/90f6c3fe8638
Assignee: bobbyholley+bmo → nobody
Component: General → DOM: Core & HTML
OS: Windows 7 → All
Product: Add-on SDK → Core
QA Contact: general → general
Hardware: x86_64 → All
Target Milestone: --- → mozilla14
Component: DOM: Core & HTML → DOM
Assignee: nobody → bobbyholley+bmo
https://hg.mozilla.org/mozilla-central/rev/90f6c3fe8638
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
And the Jetpack tests on all debug builds appear to be green, now. Thanks for the quick fix!
Status: RESOLVED → VERIFIED
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.