879856 - [debug][spew] ###!!! ASSERTION: You can't dereference a NULL nsRefPtr with operator->().: 'mRawPtr != 0', file ../../dist/include/nsAutoPtr.h, line 1022

Status: RESOLVED FIXED

(Firefox OS Graveyard :: General, defect)

Description

[Mike Habicher [:mikeh] (high bugzilla latency)]

Observed on an Inari DEBUG build:
- gecko: b2g18:09dc1ae3b1b5
- gaia: v1.0.1:37b6527c3f73a497f75d057e90386f77ff5a552b

The following line appears in large clumps, periodically, in the logcat output:

06-05 13:03:53.030   111   225 I Gecko   : [Parent 111] ###!!! ASSERTION: You can't dereference a NULL nsRefPtr with operator->().: 'mRawPtr != 0', file ../../dist/include/nsAutoPtr.h, line 1022

Even after taking the file to file this and bug 879854, logcat continues to show this in the output/.

Comment 1

[Mike Habicher [:mikeh] (high bugzilla latency)]

(In reply to Mike Habicher [:mikeh] from comment #0)
>
> Even after taking the file to file this and bug 879854, logcat continues to
> show this in the output/.

Even after taking the TIME to file this bug....

Comment 2

[Mike Habicher [:mikeh] (high bugzilla latency)]

Added a MOZ_ASSERT() after the NS_PRECONDITION() macro to catch the backtrace in gdb:

list
1018	
1019	      T*
1020	      operator->() const
1021	        {
1022	          NS_PRECONDITION(mRawPtr != 0, "You can't dereference a NULL nsRefPtr with operator->().");
1023	          MOZ_ASSERT(mRawPtr != 0);
1024	          return get();
1025	        }
1026	
1027	      // This operator is needed for gcc <= 4.0.* and for Sun Studio; it
(gdb) bt
#0  0x4140789a in nsRefPtr<mozilla::dom::telephony::TelephonyCall>::operator-> (that=<value optimized out>, p=<value optimized out>, cb=...) at ../../dist/include/nsAutoPtr.h:1023
#1  mozilla::dom::telephony::CallEvent::cycleCollection::TraverseImpl (that=<value optimized out>, p=<value optimized out>, cb=...) at /home/mikeh/dev/mozilla/m-c/b2g18/dom/telephony/CallEvent.cpp:33
#2  0x419fa51a in nsCycleCollectionParticipant::Traverse (this=0x40455050, removeChildlessNodes=true) at ../../dist/include/nsCycleCollectionParticipant.h:254
#3  MayHaveChild (this=0x40455050, removeChildlessNodes=true) at /home/mikeh/dev/mozilla/m-c/b2g18/xpcom/base/nsCycleCollector.cpp:2062
#4  nsPurpleBuffer::RemoveSkippable (this=0x40455050, removeChildlessNodes=true) at /home/mikeh/dev/mozilla/m-c/b2g18/xpcom/base/nsCycleCollector.cpp:2081
#5  0x419fb468 in nsCycleCollector::ForgetSkippable (this=0x40455000, removeChildlessNodes=true) at /home/mikeh/dev/mozilla/m-c/b2g18/xpcom/base/nsCycleCollector.cpp:2106
#6  0x419fb4a6 in nsCycleCollector_forgetSkippable (aRemoveChildlessNodes=true) at /home/mikeh/dev/mozilla/m-c/b2g18/xpcom/base/nsCycleCollector.cpp:3228
#7  0x411cc384 in FireForgetSkippable (aSuspected=1017, aRemoveChildless=true) at /home/mikeh/dev/mozilla/m-c/b2g18/dom/base/nsJSEnvironment.cpp:3141
#8  0x411d18f8 in CCTimerFired (aTimer=<value optimized out>, aClosure=<value optimized out>) at /home/mikeh/dev/mozilla/m-c/b2g18/dom/base/nsJSEnvironment.cpp:3382
#9  0x419f0ea2 in nsTimerImpl::Fire (this=0x4923ad80) at /home/mikeh/dev/mozilla/m-c/b2g18/xpcom/threads/nsTimerImpl.cpp:473
#10 0x419f109a in nsTimerEvent::Run (this=0x4044c3e0) at /home/mikeh/dev/mozilla/m-c/b2g18/xpcom/threads/nsTimerImpl.cpp:556
#11 0x419ece3e in nsThread::ProcessNextEvent (this=0x404c78d0, mayWait=<value optimized out>, result=0xbecbf6ff) at /home/mikeh/dev/mozilla/m-c/b2g18/xpcom/threads/nsThread.cpp:620
#12 0x419b4410 in NS_ProcessNextEvent_P (thread=0x55, mayWait=false) at /home/mikeh/dev/mozilla/btg024/objdir-gecko-b2g18-debug/xpcom/build/nsThreadUtils.cpp:237
#13 0x41823122 in mozilla::ipc::MessagePump::Run (this=0x404c5490, aDelegate=0x404e90c0) at /home/mikeh/dev/mozilla/m-c/b2g18/ipc/glue/MessagePump.cpp:82
#14 0x41a2369e in MessageLoop::RunInternal (this=0x404e90c0) at /home/mikeh/dev/mozilla/m-c/b2g18/ipc/chromium/src/base/message_loop.cc:219
#15 0x41a236fe in MessageLoop::RunHandler (this=0x404e90c0) at /home/mikeh/dev/mozilla/m-c/b2g18/ipc/chromium/src/base/message_loop.cc:212
#16 MessageLoop::Run (this=0x404e90c0) at /home/mikeh/dev/mozilla/m-c/b2g18/ipc/chromium/src/base/message_loop.cc:186
#17 0x4175960e in nsBaseAppShell::Run (this=0x42b0e820) at /home/mikeh/dev/mozilla/m-c/b2g18/widget/xpwidgets/nsBaseAppShell.cpp:163
#18 0x41653646 in nsAppStartup::Run (this=0x42bb01f0) at /home/mikeh/dev/mozilla/m-c/b2g18/toolkit/components/startup/nsAppStartup.cpp:290
#19 0x40c4b5e6 in XREMain::XRE_mainRun (this=0xbecbf994) at /home/mikeh/dev/mozilla/m-c/b2g18/toolkit/xre/nsAppRunner.cpp:3794
#20 0x40c4dccc in XREMain::XRE_main (this=0xbecbf994, argc=<value optimized out>, argv=0xbecc1b94, aAppData=0x21170) at /home/mikeh/dev/mozilla/m-c/b2g18/toolkit/xre/nsAppRunner.cpp:3860
#21 0x40c4de7a in XRE_main (argc=1, argv=0xbecc1b94, aAppData=0x21170, aFlags=<value optimized out>) at /home/mikeh/dev/mozilla/m-c/b2g18/toolkit/xre/nsAppRunner.cpp:3935
#22 0x00009b12 in do_main (argc=1, argv=0xbecc1b94) at /home/mikeh/dev/mozilla/m-c/b2g18/b2g/app/nsBrowserApp.cpp:168
#23 main (argc=1, argv=0xbecc1b94) at /home/mikeh/dev/mozilla/m-c/b2g18/b2g/app/nsBrowserApp.cpp:261

Comment 3

[Ben Turner (not reading bugmail, use the needinfo flag!)]

This is a regression from bug 823958.

We need to null-check tmp->mCall here before traversing:

http://mxr.mozilla.org/mozilla-b2g18/source/dom/telephony/CallEvent.cpp#33

Comment 4

[Hsin-Yi Tsai (she/her) | away [:hsinyi]]

(In reply to ben turner [:bent] from comment #3)
> This is a regression from bug 823958.
> 
> We need to null-check tmp->mCall here before traversing:
> 
> http://mxr.mozilla.org/mozilla-b2g18/source/dom/telephony/CallEvent.cpp#33

Sorry, my bad, and thanks for the catch.

Comment 5

[Hsin-Yi Tsai (she/her) | away [:hsinyi]]

Attachment: null-check tmp->mCall before traversing

Comment #3 addressed. Thanks.

Comment 6

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Comment on attachment 759006 [details] [diff] [review]
null-check tmp->mCall before traversing

Looks good!

Comment 7

[Hsin-Yi Tsai (she/her) | away [:hsinyi]]

This should be leo+ since it's a regression of a leo+ bug. And this issue happens on b2g-18 only (no m-c). Nominate it again.

Comment 8

[Lukas Blakk [:lsblakk] use ?needinfo]

Blocking so it can be uplifted to fix regression from leo+ bug.

Comment 9

[Hsin-Yi Tsai (she/her) | away [:hsinyi]]

Attachment: b2g18 patch, no need to land on m-c

Comment 10

[Hsin-Yi Tsai (she/her) | away [:hsinyi]]

Comment on attachment 760716 [details] [diff] [review]
b2g18 patch, no need to land on m-c

This bug happens on b2g18 only, as no CallEvent.cpp exits in m-c anymore. We shall not follow the normal landing procedure here. Could you please help land this on b2g18 directly, RyanVM? Thank you.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g18/rev/6af7223453e1