931271 - B2G parent assertion: MOZ_ASSERT(JS_IsExceptionPending(cx)) at EventListenerBinding.cpp:27

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Gregor Wagner [:gwagner]]

with debug build on nexus4, current b2g-inbound and gaia trunk.
STR: opening multiple mlb.com tabs

Program received signal SIGSEGV, Segmentation fault.
0xb4f7c546 in mozilla::dom::EventListener::HandleEvent (this=0xae4c6860, cx=<optimized out>, aThisObj=..., event=..., aRv=...) at EventListenerBinding.cpp:27
27	      MOZ_ASSERT(JS_IsExceptionPending(cx));
(gdb) [Child 2557] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80040111: file ../../../../dom/src/storage/DOMStorageManager.cpp, line 460
[Child 2557] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80040111: file ../../../dom/base/nsGlobalWindow.cpp, line 9866
[Child 2557] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80040111: file ../../../../dom/src/storage/DOMStorageManager.cpp, line 460
[Child 2557] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80040111: file ../../../dom/base/nsGlobalWindow.cpp, line 9866
bt
#0  0xb4f7c546 in mozilla::dom::EventListener::HandleEvent (this=0xae4c6860, cx=<optimized out>, aThisObj=..., event=..., aRv=...) at EventListenerBinding.cpp:27
#1  0xb487e260 in mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*> (this=0xae4c6860, thisObj=<optimized out>, event=..., aRv=..., aExceptionHandling=mozilla::dom::CallbackObject::eReportExceptions) at ../../../dist/include/mozilla/dom/EventListenerBinding.h:51
#2  0xb487e320 in nsEventListenerManager::HandleEventSubType (this=0xae4d4760, aListenerStruct=<optimized out>, aListener=..., aDOMEvent=0xa7a6f270, aCurrentTarget=0xb02a5900, aPusher=0xbe774360) at ../../../../content/events/src/nsEventListenerManager.cpp:952
#3  0xb487e520 in nsEventListenerManager::HandleEventInternal (this=0xae4d4760, aPresContext=0xae43c000, aEvent=0xbe7743f8, aDOMEvent=0xbe774328, aCurrentTarget=0xb02a5900, aEventStatus=0xbe77432c, aPusher=0xbe774360) at ../../../../content/events/src/nsEventListenerManager.cpp:1029
#4  0xb487a048 in HandleEvent (aPusher=0xbe774360, aEventStatus=0xbe77432c, aCurrentTarget=0xb02a5900, aDOMEvent=0xbe774328, aEvent=<optimized out>, aPresContext=<optimized out>, this=<optimized out>) at ../../../../content/events/src/nsEventListenerManager.h:326
#5  nsEventTargetChainItem::HandleEvent (this=<optimized out>, aVisitor=..., aCd=<optimized out>, aPusher=0xbe774360) at ../../../../content/events/src/nsEventDispatcher.cpp:197
#6  0xb487abba in nsEventTargetChainItem::HandleEventTargetChain (aChain=..., aVisitor=..., aCallback=0xbe7744c8, aCd=..., aPusher=0xbe774360) at ../../../../content/events/src/nsEventDispatcher.cpp:313
#7  0xb487b4f4 in nsEventDispatcher::Dispatch (aTarget=<optimized out>, aPresContext=0xae43c000, aEvent=0xbe7743f8, aDOMEvent=0x0, aEventStatus=0xbe7743e8, aCallback=0xbe7744c8, aTargets=0x0) at ../../../../content/events/src/nsEventDispatcher.cpp:609
#8  0xb464e2b4 in PresShell::DispatchTouchEvent (this=0xaf7d8340, aEvent=<optimized out>, aStatus=0xbe774628, aEventCB=0xbe7744c8, aTouchIsNew=true) at ../../../layout/base/nsPresShell.cpp:6988
#9  0xb4655114 in PresShell::HandleEventInternal (this=0xaf7d8340, aEvent=0xbe774680, aStatus=0xbe774628) at ../../../layout/base/nsPresShell.cpp:6876
#10 0xb4655494 in PresShell::HandlePositionedEvent (this=0xaf7d8340, aTargetFrame=<optimized out>, aEvent=0xbe774680, aEventStatus=0xbe774628) at ../../../layout/base/nsPresShell.cpp:6599
#11 0xb4655b9e in HandleEvent (aEventStatus=0xbe774628, aDontRetargetEvents=<optimized out>, aEvent=0xbe774680, aFrame=<optimized out>, this=0xb203d280) at ../../../layout/base/nsPresShell.cpp:6398
#12 PresShell::HandleEvent (this=0xb203d280, aFrame=<optimized out>, aEvent=0xbe774680, aDontRetargetEvents=<optimized out>, aEventStatus=0xbe774628) at ../../../layout/base/nsPresShell.cpp:6009
#13 0xb499b356 in nsViewManager::DispatchEvent (this=<optimized out>, aEvent=0xbe774680, aView=<optimized out>, aStatus=0xbe774628) at ../../../view/src/nsViewManager.cpp:752
#14 0xb49990dc in nsView::HandleEvent (this=<optimized out>, aEvent=0xbe774680, aUseAttachedEvents=<optimized out>) at ../../../view/src/nsView.cpp:1084
#15 0xb4dbca22 in nsWindow::DispatchEvent (this=0xafb84250, aEvent=<optimized out>, aStatus=@0xbe774654) at ../../../widget/gonk/nsWindow.cpp:484
#16 0xb4dbdc92 in nsWindow::DispatchInputEvent (aEvent=..., aWasCaptured=0xbe77467f) at ../../../widget/gonk/nsWindow.cpp:288
#17 0xb4dbc154 in sendTouchEvent (captured=0xbe77467f, data=...) at ../../../widget/gonk/nsAppShell.cpp:215
#18 GeckoInputDispatcher::dispatchOnce (this=<optimized out>) at ../../../widget/gonk/nsAppShell.cpp:523
#19 0xb4dbb0de in nsAppShell::ProcessNextNativeEvent (this=0xb2036e20, mayWait=<optimized out>) at ../../../widget/gonk/nsAppShell.cpp:846
#20 0xb4dc251c in nsBaseAppShell::DoProcessNextNativeEvent (this=0xb2036e20, mayWait=<optimized out>, recursionDepth=0) at ../../../widget/xpwidgets/nsBaseAppShell.cpp:137
#21 0xb4dc25d0 in nsBaseAppShell::OnProcessNextEvent (this=0xb2036e20, thr=0xb6a02390, mayWait=true, recursionDepth=0) at ../../../widget/xpwidgets/nsBaseAppShell.cpp:283
#22 0xb512aa92 in nsThread::ProcessNextEvent (this=0xb6a02390, mayWait=<optimized out>, result=0xbe774e28) at ../../../xpcom/threads/nsThread.cpp:595
#23 0xb513d406 in NS_InvokeByIndex (that=0xb6a02390, methodIndex=8, paramCount=<optimized out>, params=<optimized out>) at ../../../../../../../xpcom/reflect/xptcall/src/md/unix/xptcinvoke_arm.cpp:164
#24 0xb4cac5b2 in Invoke (this=0xbe774df0) at ../../../../js/xpconnect/src/XPCWrappedNative.cpp:2797
#25 CallMethodHelper::Call (this=0xbe774df0) at ../../../../js/xpconnect/src/XPCWrappedNative.cpp:2137
#26 0xb4cac9d4 in XPCWrappedNative::CallMethod (ccx=..., mode=XPCWrappedNative::CALL_METHOD) at ../../../../js/xpconnect/src/XPCWrappedNative.cpp:2103
#27 0xb4caf196 in XPC_WN_CallMethod (cx=0xb6ad5bc0, argc=1, vp=<optimized out>) at ../../../../js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1308
#28 0xb56c4458 in js::CallJSNative (cx=0xb6ad5bc0, native=0xb4caf0a1 <XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*)>, args=...) at ../../../js/src/jscntxtinlines.h:220
#29 0xb56cdcac in js::Invoke (cx=0xb6ad5bc0, args=..., construct=js::NO_CONSTRUCT) at ../../../js/src/vm/Interpreter.cpp:463
#30 0xb56cb818 in Interpret (cx=0xb6ad5bc0, state=...) at ../../../js/src/vm/Interpreter.cpp:2466
#31 0xb56cd520 in js::RunScript (cx=0xb6ad5bc0, state=...) at ../../../js/src/vm/Interpreter.cpp:420
#32 0xb56cdc34 in RunScript (state=..., cx=0xb6ad5bc0) at ../../../js/src/vm/Interpreter.cpp:389
#33 js::Invoke (cx=0xb6ad5bc0, args=..., construct=js::NO_CONSTRUCT) at ../../../js/src/vm/Interpreter.cpp:482
#34 0xb55e9f38 in js::CallOrConstructBoundFunction (cx=<optimized out>, argc=1, vp=0xbe775f20) at ../../../js/src/jsfun.cpp:1257
#35 0xb56c4458 in js::CallJSNative (cx=0xb6ad5bc0, native=0xb55e9d9d <js::CallOrConstructBoundFunction(JSContext*, unsigned int, JS::Value*)>, args=...) at ../../../js/src/jscntxtinlines.h:220
#36 0xb56cdcac in js::Invoke (cx=0xb6ad5bc0, args=..., construct=js::NO_CONSTRUCT) at ../../../js/src/vm/Interpreter.cpp:463
#37 0xb56ce334 in js::Invoke (cx=0xb6ad5bc0, thisv=..., fval=<optimized out>, argc=1, argv=0xbe776188, rval=...) at ../../../js/src/vm/Interpreter.cpp:513
#38 0xb559d7c2 in JS_CallFunctionValue (cx=0xb6ad5bc0, objArg=<optimized out>, fval=..., argc=1, argv=0xbe776188, rval=0xbe776110) at ../../../js/src/jsapi.cpp:5070
#39 0xb4ca76d8 in nsXPCWrappedJSClass::CallMethod (this=0xaf2f8160, wrapper=<optimized out>, methodIndex=<optimized out>, info_=0xb230e2e0, nativeParams=0xbe776300) at ../../../../js/xpconnect/src/XPCWrappedJSClass.cpp:1423
#40 0xb4ca3ec4 in nsXPCWrappedJS::CallMethod (this=0xaf3b8880, methodIndex=<optimized out>, info=0xb230e2e0, params=0xbe776300) at ../../../../js/xpconnect/src/XPCWrappedJS.cpp:591
#41 0xb513dcee in PrepareAndDispatch (self=0xb024dda0, methodIndex=<optimized out>, args=<optimized out>) at ../../../../../../../xpcom/reflect/xptcall/src/md/unix/xptcstubs_arm.cpp:105
#42 0xb513d41c in SharedStub () from /Volumes/mac/moz/ib2g/debnexusbuild/dist/bin/libxul.so
#43 0xb487e36c in nsEventListenerManager::HandleEventSubType (this=0xaead7a60, aListenerStruct=<optimized out>, aListener=..., aDOMEvent=0xa7a6e780, aCurrentTarget=0xaead74c0, aPusher=0xbe776578) at ../../../../content/events/src/nsEventListenerManager.cpp:955
#44 0xb487e520 in nsEventListenerManager::HandleEventInternal (this=0xaead7a60, aPresContext=0xae43c000, aEvent=0xbe776610, aDOMEvent=0xbe776540, aCurrentTarget=0xaead74c0, aEventStatus=0xbe776544, aPusher=0xbe776578) at ../../../../content/events/src/nsEventListenerManager.cpp:1029
#45 0xb487a048 in HandleEvent (aPusher=0xbe776578, aEventStatus=0xbe776544, aCurrentTarget=0xaead74c0, aDOMEvent=0xbe776540, aEvent=<optimized out>, aPresContext=<optimized out>, this=<optimized out>) at ../../../../content/events/src/nsEventListenerManager.h:326
#46 nsEventTargetChainItem::HandleEvent (this=<optimized out>, aVisitor=..., aCd=<optimized out>, aPusher=0xbe776578) at ../../../../content/events/src/nsEventDispatcher.cpp:197
#47 0xb487abba in nsEventTargetChainItem::HandleEventTargetChain (aChain=..., aVisitor=..., aCallback=0xbe7766e0, aCd=..., aPusher=0xbe776578) at ../../../../content/events/src/nsEventDispatcher.cpp:313
#48 0xb487ab60 in nsEventTargetChainItem::HandleEventTargetChain (aChain=..., aVisitor=..., aCallback=0xbe7766e0, aCd=..., aPusher=0xbe776578) at ../../../../content/events/src/nsEventDispatcher.cpp:346
#49 0xb487b4f4 in nsEventDispatcher::Dispatch (aTarget=<optimized out>, aPresContext=0xae43c000, aEvent=0xbe776610, aDOMEvent=0x0, aEventStatus=0xbe776600, aCallback=0xbe7766e0, aTargets=0x0) at ../../../../content/events/src/nsEventDispatcher.cpp:609
#50 0xb464e2b4 in PresShell::DispatchTouchEvent (this=0xaf7d8340, aEvent=<optimized out>, aStatus=0xbe776840, aEventCB=0xbe7766e0, aTouchIsNew=false) at ../../../layout/base/nsPresShell.cpp:6988
#51 0xb4655114 in PresShell::HandleEventInternal (this=0xaf7d8340, aEvent=0xbe776898, aStatus=0xbe776840) at ../../../layout/base/nsPresShell.cpp:6876
#52 0xb4655494 in PresShell::HandlePositionedEvent (this=0xaf7d8340, aTargetFrame=<optimized out>, aEvent=0xbe776898, aEventStatus=0xbe776840) at ../../../layout/base/nsPresShell.cpp:6599
#53 0xb4655b9e in HandleEvent (aEventStatus=0xbe776840, aDontRetargetEvents=<optimized out>, aEvent=0xbe776898, aFrame=<optimized out>, this=0xb203d280) at ../../../layout/base/nsPresShell.cpp:6398
#54 PresShell::HandleEvent (this=0xb203d280, aFrame=<optimized out>, aEvent=0xbe776898, aDontRetargetEvents=<optimized out>, aEventStatus=0xbe776840) at ../../../layout/base/nsPresShell.cpp:6009
#55 0xb499b356 in nsViewManager::DispatchEvent (this=<optimized out>, aEvent=0xbe776898, aView=<optimized out>, aStatus=0xbe776840) at ../../../view/src/nsViewManager.cpp:752
#56 0xb49990dc in nsView::HandleEvent (this=<optimized out>, aEvent=0xbe776898, aUseAttachedEvents=<optimized out>) at ../../../view/src/nsView.cpp:1084
#57 0xb4dbca22 in nsWindow::DispatchEvent (this=0xafb84250, aEvent=<optimized out>, aStatus=@0xbe77686c) at ../../../widget/gonk/nsWindow.cpp:484
#58 0xb4dbdc92 in nsWindow::DispatchInputEvent (aEvent=..., aWasCaptured=0xbe776897) at ../../../widget/gonk/nsWindow.cpp:288
#59 0xb4dbc154 in sendTouchEvent (captured=0xbe776897, data=...) at ../../../widget/gonk/nsAppShell.cpp:215
#60 GeckoInputDispatcher::dispatchOnce (this=<optimized out>) at ../../../widget/gonk/nsAppShell.cpp:523
#61 0xb4dbb0de in nsAppShell::ProcessNextNativeEvent (this=0xb2036e20, mayWait=<optimized out>) at ../../../widget/gonk/nsAppShell.cpp:846
#62 0xb4dc251c in nsBaseAppShell::DoProcessNextNativeEvent (this=0xb2036e20, mayWait=<optimized out>, recursionDepth=0) at ../../../widget/xpwidgets/nsBaseAppShell.cpp:137
#63 0xb4dc25e8 in nsBaseAppShell::OnProcessNextEvent (this=0xb2036e20, thr=0xb6a02390, mayWait=false, recursionDepth=0) at ../../../widget/xpwidgets/nsBaseAppShell.cpp:295
#64 0xb512aa92 in nsThread::ProcessNextEvent (this=0xb6a02390, mayWait=<optimized out>, result=0xbe777040) at ../../../xpcom/threads/nsThread.cpp:595
#65 0xb513d406 in NS_InvokeByIndex (that=0xb6a02390, methodIndex=8, paramCount=<optimized out>, params=<optimized out>) at ../../../../../../../xpcom/reflect/xptcall/src/md/unix/xptcinvoke_arm.cpp:164
#66 0xb4cac5b2 in Invoke (this=0xbe777008) at ../../../../js/xpconnect/src/XPCWrappedNative.cpp:2797
---Type <return> to continue, or q <return> to quit---q
Quit
(gdb) p this
$1 = (mozilla::dom::EventListener * const) 0xae4c6860
(gdb) p *this
$2 = {<mozilla::dom::CallbackInterface> = {<mozilla::dom::CallbackObject> = {<nsISupports> = {_vptr.nsISupports = 0xb62b0068}, mRefCnt = {mRefCntAndFlags = 9}, _mOwningThread = {mThread = 0xb6a34080}, static _cycleCollectorGlobal = {
    <nsXPCOMCycleCollectionParticipant> = {<nsScriptObjectTracer> = {<nsCycleCollectionParticipant> = {_vptr.nsCycleCollectionParticipant = 0xb62cfa40, mMightSkip = false}, <No data fields>}, <No data fields>}, <No data fields>}, mCallback = {<js::HeapBase<JSObject*>> = {<No data fields>}, 
        ptr = 0xb2154ca0}}, <No data fields>}, <No data fields>}
(gdb) l
22	  }
23	  unsigned argc = 1;
24	
25	  do {
26	    if (!WrapNewBindingObject(cx, CallbackPreserveColor(), event, argv.handleAt(0))) {
27	      MOZ_ASSERT(JS_IsExceptionPending(cx));
28	      aRv.Throw(NS_ERROR_UNEXPECTED);
29	      return;
30	    }
31	    break;
(gdb) p cx
$3 = <optimized out>
(gdb) p event
$4 = (nsDOMEvent &) @0xa7a6f270: {<nsDOMEventBase> = {<nsIDOMEvent> = {<nsISupports> = {_vptr.nsISupports = 0xb6200408}, <No data fields>}, <No data fields>}, <nsWrapperCache> = {_vptr.nsWrapperCache = 0xb62004d0, mWrapper = {<js::HeapBase<JSObject*>> = {<No data fields>}, ptr = 0x0}, 
    mFlags = 2}, mRefCnt = {mRefCntAndFlags = 8}, _mOwningThread = {mThread = 0xb6a34080}, static _cycleCollectorGlobal = {<nsXPCOMCycleCollectionParticipant> = {<nsScriptObjectTracer> = {<nsCycleCollectionParticipant> = {_vptr.nsCycleCollectionParticipant = 0xb61feaa8, 
          mMightSkip = false}, <No data fields>}, <No data fields>}, <No data fields>}, mEvent = 0xbe7743f8, mPresContext = {mRawPtr = 0xae43c000}, mExplicitOriginalTarget = {mRawPtr = 0x0}, mOwner = {mRawPtr = 0xb02a5910}, mEventIsInternal = false, mPrivateDataDuplicated = false, 
  mIsMainThreadEvent = true}
(gdb)

Comment 1

[Boris Zbarsky [:bzbarsky]]

Gregor, can you reproduce this reliably?

If so, what is the concrete type of "event" in this case?  I mean the most-derived type, not just nsDOMEvent.

Comment 2

[Gregor Wagner [:gwagner]]

I couldn't reproduce it any more today. I will reopen if I see it again.