922837 - In IndexedDatabaseManager.cpp:235: Assertion failure: js::GetObjectClass(aGlobal)->flags & (1<<7) (Not a global object!)

Status: RESOLVED FIXED

(Core :: Storage: IndexedDB, defect)

Description

[Kelsey Gilbert [:jgilbert]]

My local build of central started hitting this consistently:
F/MOZ_Assert(12226): Assertion failure: js::GetObjectClass(aGlobal)->flags & (1<<7) (Not a global object!), at mozilla/central/dom/indexedDB/IndexedDatabaseManager.cpp:235

I get this on my Galaxy Tab 10.1:
First, google "webgl test".
Choose your adventure:
1) Click "Testing/Conformance - WebGL Public Wiki".
2) Click another result on that page.
3) Just wait about 20s.

All three end with the browser asserting out.

Comment 1

[Kelsey Gilbert [:jgilbert]]

Any ideas? This also reproduces on my Nexus 10.

Comment 2

[Kelsey Gilbert [:jgilbert]]

This also happens on etherpad.mozilla.org, apparently on any etherpad. (Either create a new one and wait, or access and old one, and wait)

Comment 3

[Kelsey Gilbert [:jgilbert]]

It also happens on:
https://www.khronos.org/registry/webgl/
https://www.khronos.org/registry/webgl/conformance-suites/
https://www.khronos.org/registry/webgl/conformance-suites/1.0.1/webgl-conformance-tests.html

At this point, it's notable that the only site I've tried which doesn't do this is slashdot.org's frontpage, and the one story page I tried.

This is making it impossible to do DEBUG testing against central.

Comment 5

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

This code is clearly bogus, JS can apply the lazy getter to anything it wants, not just a global.

Comment 6

[Bobby Holley (:bholley)]

The lazy getter should just go away, and we should do bug 920553.

Comment 7

[Bobby Holley (:bholley)]

For the moment we probably just need to innerize in IndexedDBLazyGetter.

Comment 8

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Jan is going to take this.

Comment 9

[Jan Varga [:janv]]

https://tbpl.mozilla.org/?tree=Try&rev=bbf6ffad7bd9

Comment 10

[Bobby Holley (:bholley)]

    1.38 +  JS::RootedObject global(aCx, CheckedUnwrap(aGlobal, false));

Note that CheckedUnwrap can veto and return null, which may well happen if somebody applies the lazy getter to a security wrapper.

I think the most robust thing for now is to do:
JS::RootedObject global(aCx, CheckedUnwrap(aGlobal, false));
NS_ENSURE_TRUE(global, false);
NS_ENSURE_TRUE(js::GetObjectClass(global)->flags & JSCLASS_DOM_GLOBAL, false);

Comment 11

[Jan Varga [:janv]]

Attachment: patch

Comment 12

[Bobby Holley (:bholley)]

Comment on attachment 813084 [details] [diff] [review]
patch

Review of attachment 813084 [details] [diff] [review]:
-----------------------------------------------------------------

::: dom/indexedDB/IndexedDatabaseManager.cpp
@@ +234,5 @@
>    MOZ_ASSERT(JSID_IS_STRING(aId), "Bad id!");
>    MOZ_ASSERT(JS_FlatStringEqualsAscii(JSID_TO_FLAT_STRING(aId), IDB_STR),
>               "Bad id!");
>  
> +  JS::RootedObject global(aCx, CheckedUnwrap(aGlobal, false));

Please add /* stopAtOuter = */ before the |false| parameter.

Comment 13

[Jan Varga [:janv]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e02d4a452afc

Comment 14

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/e02d4a452afc