Closed Bug 879856 Opened 11 years ago Closed 11 years ago

[debug][spew] ###!!! ASSERTION: You can't dereference a NULL nsRefPtr with operator->().: 'mRawPtr != 0', file ../../dist/include/nsAutoPtr.h, line 1022

Categories

(Firefox OS Graveyard :: General, defect)

ARM
Gonk (Firefox OS)
defect
Not set
normal

Tracking

(blocking-b2g:leo+, firefox24 unaffected, b2g18 fixed, b2g18-v1.0.0 wontfix, b2g18-v1.0.1 wontfix, b2g-v1.1hd affected)

RESOLVED FIXED
1.1 QE3 (26jun)
blocking-b2g leo+
Tracking Status
firefox24 --- unaffected
b2g18 --- fixed
b2g18-v1.0.0 --- wontfix
b2g18-v1.0.1 --- wontfix
b2g-v1.1hd --- affected

People

(Reporter: mikeh, Assigned: hsinyi)

References

Details

(Keywords: regression)

Attachments

(1 file, 1 obsolete file)

Observed on an Inari DEBUG build:
- gecko: b2g18:09dc1ae3b1b5
- gaia: v1.0.1:37b6527c3f73a497f75d057e90386f77ff5a552b

The following line appears in large clumps, periodically, in the logcat output:

06-05 13:03:53.030   111   225 I Gecko   : [Parent 111] ###!!! ASSERTION: You can't dereference a NULL nsRefPtr with operator->().: 'mRawPtr != 0', file ../../dist/include/nsAutoPtr.h, line 1022

Even after taking the file to file this and bug 879854, logcat continues to show this in the output/.
Summary: ###!!! ASSERTION: You can't dereference a NULL nsRefPtr with operator->().: 'mRawPtr != 0', file ../../dist/include/nsAutoPtr.h, line 1022 → [debug][spew] ###!!! ASSERTION: You can't dereference a NULL nsRefPtr with operator->().: 'mRawPtr != 0', file ../../dist/include/nsAutoPtr.h, line 1022
(In reply to Mike Habicher [:mikeh] from comment #0)
>
> Even after taking the file to file this and bug 879854, logcat continues to
> show this in the output/.

Even after taking the TIME to file this bug....
Added a MOZ_ASSERT() after the NS_PRECONDITION() macro to catch the backtrace in gdb:

list
1018	
1019	      T*
1020	      operator->() const
1021	        {
1022	          NS_PRECONDITION(mRawPtr != 0, "You can't dereference a NULL nsRefPtr with operator->().");
1023	          MOZ_ASSERT(mRawPtr != 0);
1024	          return get();
1025	        }
1026	
1027	      // This operator is needed for gcc <= 4.0.* and for Sun Studio; it
(gdb) bt
#0  0x4140789a in nsRefPtr<mozilla::dom::telephony::TelephonyCall>::operator-> (that=<value optimized out>, p=<value optimized out>, cb=...) at ../../dist/include/nsAutoPtr.h:1023
#1  mozilla::dom::telephony::CallEvent::cycleCollection::TraverseImpl (that=<value optimized out>, p=<value optimized out>, cb=...) at /home/mikeh/dev/mozilla/m-c/b2g18/dom/telephony/CallEvent.cpp:33
#2  0x419fa51a in nsCycleCollectionParticipant::Traverse (this=0x40455050, removeChildlessNodes=true) at ../../dist/include/nsCycleCollectionParticipant.h:254
#3  MayHaveChild (this=0x40455050, removeChildlessNodes=true) at /home/mikeh/dev/mozilla/m-c/b2g18/xpcom/base/nsCycleCollector.cpp:2062
#4  nsPurpleBuffer::RemoveSkippable (this=0x40455050, removeChildlessNodes=true) at /home/mikeh/dev/mozilla/m-c/b2g18/xpcom/base/nsCycleCollector.cpp:2081
#5  0x419fb468 in nsCycleCollector::ForgetSkippable (this=0x40455000, removeChildlessNodes=true) at /home/mikeh/dev/mozilla/m-c/b2g18/xpcom/base/nsCycleCollector.cpp:2106
#6  0x419fb4a6 in nsCycleCollector_forgetSkippable (aRemoveChildlessNodes=true) at /home/mikeh/dev/mozilla/m-c/b2g18/xpcom/base/nsCycleCollector.cpp:3228
#7  0x411cc384 in FireForgetSkippable (aSuspected=1017, aRemoveChildless=true) at /home/mikeh/dev/mozilla/m-c/b2g18/dom/base/nsJSEnvironment.cpp:3141
#8  0x411d18f8 in CCTimerFired (aTimer=<value optimized out>, aClosure=<value optimized out>) at /home/mikeh/dev/mozilla/m-c/b2g18/dom/base/nsJSEnvironment.cpp:3382
#9  0x419f0ea2 in nsTimerImpl::Fire (this=0x4923ad80) at /home/mikeh/dev/mozilla/m-c/b2g18/xpcom/threads/nsTimerImpl.cpp:473
#10 0x419f109a in nsTimerEvent::Run (this=0x4044c3e0) at /home/mikeh/dev/mozilla/m-c/b2g18/xpcom/threads/nsTimerImpl.cpp:556
#11 0x419ece3e in nsThread::ProcessNextEvent (this=0x404c78d0, mayWait=<value optimized out>, result=0xbecbf6ff) at /home/mikeh/dev/mozilla/m-c/b2g18/xpcom/threads/nsThread.cpp:620
#12 0x419b4410 in NS_ProcessNextEvent_P (thread=0x55, mayWait=false) at /home/mikeh/dev/mozilla/btg024/objdir-gecko-b2g18-debug/xpcom/build/nsThreadUtils.cpp:237
#13 0x41823122 in mozilla::ipc::MessagePump::Run (this=0x404c5490, aDelegate=0x404e90c0) at /home/mikeh/dev/mozilla/m-c/b2g18/ipc/glue/MessagePump.cpp:82
#14 0x41a2369e in MessageLoop::RunInternal (this=0x404e90c0) at /home/mikeh/dev/mozilla/m-c/b2g18/ipc/chromium/src/base/message_loop.cc:219
#15 0x41a236fe in MessageLoop::RunHandler (this=0x404e90c0) at /home/mikeh/dev/mozilla/m-c/b2g18/ipc/chromium/src/base/message_loop.cc:212
#16 MessageLoop::Run (this=0x404e90c0) at /home/mikeh/dev/mozilla/m-c/b2g18/ipc/chromium/src/base/message_loop.cc:186
#17 0x4175960e in nsBaseAppShell::Run (this=0x42b0e820) at /home/mikeh/dev/mozilla/m-c/b2g18/widget/xpwidgets/nsBaseAppShell.cpp:163
#18 0x41653646 in nsAppStartup::Run (this=0x42bb01f0) at /home/mikeh/dev/mozilla/m-c/b2g18/toolkit/components/startup/nsAppStartup.cpp:290
#19 0x40c4b5e6 in XREMain::XRE_mainRun (this=0xbecbf994) at /home/mikeh/dev/mozilla/m-c/b2g18/toolkit/xre/nsAppRunner.cpp:3794
#20 0x40c4dccc in XREMain::XRE_main (this=0xbecbf994, argc=<value optimized out>, argv=0xbecc1b94, aAppData=0x21170) at /home/mikeh/dev/mozilla/m-c/b2g18/toolkit/xre/nsAppRunner.cpp:3860
#21 0x40c4de7a in XRE_main (argc=1, argv=0xbecc1b94, aAppData=0x21170, aFlags=<value optimized out>) at /home/mikeh/dev/mozilla/m-c/b2g18/toolkit/xre/nsAppRunner.cpp:3935
#22 0x00009b12 in do_main (argc=1, argv=0xbecc1b94) at /home/mikeh/dev/mozilla/m-c/b2g18/b2g/app/nsBrowserApp.cpp:168
#23 main (argc=1, argv=0xbecc1b94) at /home/mikeh/dev/mozilla/m-c/b2g18/b2g/app/nsBrowserApp.cpp:261
This is a regression from bug 823958.

We need to null-check tmp->mCall here before traversing:

http://mxr.mozilla.org/mozilla-b2g18/source/dom/telephony/CallEvent.cpp#33
Blocks: 823958
(In reply to ben turner [:bent] from comment #3)
> This is a regression from bug 823958.
> 
> We need to null-check tmp->mCall here before traversing:
> 
> http://mxr.mozilla.org/mozilla-b2g18/source/dom/telephony/CallEvent.cpp#33

Sorry, my bad, and thanks for the catch.
Comment #3 addressed. Thanks.
Attachment #759006 - Flags: review?(bent.mozilla)
Comment on attachment 759006 [details] [diff] [review]
null-check tmp->mCall before traversing

Looks good!
Attachment #759006 - Flags: review?(bent.mozilla) → review+
This should be leo+ since it's a regression of a leo+ bug. And this issue happens on b2g-18 only (no m-c). Nominate it again.
Blocking so it can be uplifted to fix regression from leo+ bug.
blocking-b2g: leo? → leo+
tracking-b2g18: ? → ---
Comment on attachment 760716 [details] [diff] [review]
b2g18 patch, no need to land on m-c

This bug happens on b2g18 only, as no CallEvent.cpp exits in m-c anymore. We shall not follow the normal landing procedure here. Could you please help land this on b2g18 directly, RyanVM? Thank you.
Attachment #760716 - Attachment description: b2g18 patch → b2g18 patch, no need to land on m-c
Keywords: checkin-needed
Attachment #759006 - Attachment is obsolete: true
https://hg.mozilla.org/releases/mozilla-b2g18/rev/6af7223453e1
Assignee: nobody → htsai
Status: NEW → RESOLVED
Closed: 11 years ago
Keywords: checkin-needed
Resolution: --- → FIXED
Target Milestone: --- → 1.1 QE3
Flags: in-moztrap-
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: