Closed Bug 937006 Opened 7 years ago Closed 7 years ago

"Hit MOZ_CRASH(Failed to get caller.)" using setTimeout on IndexedDB call

Categories

(Core :: Storage: IndexedDB, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla28

People

(Reporter: jruderman, Assigned: baku)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(3 files, 2 obsolete files)

Hit MOZ_CRASH(Failed to get caller.) at dom/indexedDB/IDBRequest.cpp:281

Bug 933351 added this MOZ_CRASH line (actually, upgraded it from a warning).

Nightly: bp-4e09ae5c-0a5d-4c5d-8568-5c8ba2131111
Attached file stack (gdb)
Looks like the assumptions in the patch from bug 933351 Were not valid. Andrea, can you take a look?
Assignee: nobody → amarchesini
Flags: needinfo?(amarchesini)
Wait, a window is running a timeout... How is it possible that we can't dig out the file/line info from that?
It crashes because of the .bind(indexedDB). In IDBRequest.cpp we call |nsJSUtils::GetCallingLocation()| that calls |JS_DescribeScriptedCaller()|. This function return false (error) if the callee is not a JS script. In this case it's not.
Flags: needinfo?(amarchesini)
Attached patch crash.patch (obsolete) — Splinter Review
This patch adds a mochitest and replaces the crash with a warning.
Attachment #8335261 - Flags: review?(bobbyholley+bmo)
Comment on attachment 8335261 [details] [diff] [review]
crash.patch

Review of attachment 8335261 [details] [diff] [review]:
-----------------------------------------------------------------

(In reply to Andrea Marchesini (:baku) from comment #4)
> It crashes because of the .bind(indexedDB). In IDBRequest.cpp we call
> |nsJSUtils::GetCallingLocation()| that calls |JS_DescribeScriptedCaller()|.
> This function return false (error) if the callee is not a JS script. In this
> case it's not.

Ahah! This was a case that was undefined in the spec until recently, when Boris, Hixie and I sorted it out. The new strategy is that callbacks (passed to timeouts and such) capture their incumbent script, and restore it onto the stack when they're invoked.

Please file a followup bug on turning this back into a MOZ_CRASH, and make it depend on bug 937317. r=bholley with that.

::: dom/indexedDB/test/test_bug937006.html
@@ +11,5 @@
> +  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
> +
> +<script>
> +
> +setTimeout(indexedDB.deleteDatabase.bind(indexedDB), 0, 'x');

Please add a comment here explaining what this is doing.
Attachment #8335261 - Flags: review?(bobbyholley+bmo) → review+
Attached patch crash.patch (obsolete) — Splinter Review
Attachment #8335261 - Attachment is obsolete: true
Blocks: 941069
The test should have been just added to testing/mochitest/b2g-desktop.json
I'll re-enable this mochitest in a followup
https://hg.mozilla.org/mozilla-central/rev/125b1813b9da
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
Flags: in-testsuite?
You need to log in before you can comment on or make changes to this bug.