767643 - Incremental GC: Assertion failure in jsgc.cpp leading to a crash

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Thaddee Tyl [:espadrine]]

While browsing on a fx-team build, I got the following error leading to a crash:

Assertion failure: false, at /home/tyl/files/cloud/fx-team/js/src/jsgc.cpp:3182

Stack: <http://pastebin.mozilla.org/1670658>
Backtrace: <http://pastebin.mozilla.org/1670655>

Comment 1

[Luke Wagner [:luke]]

A js_InvokeOperationCallback during scripted QueryInterface (for a WrappedJSClass) which is called while converting the parameters of an XPC call.  What could go wrong?

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

What revision is this? I can't figure out which assertion is hitting.

Can you make this happen more than once?

Comment 3

[Thaddee Tyl [:espadrine]]

Revision: 97352:06873a64a192 (merge to fx-team).
I believe the latest commit to the JS subtree was 97341:14305028261b (meaning, the most recent commit in my branch history; this commit is very likely not responsible).

I cannot make it happen again. I have no idea if there is a reproducible way to do it over again. I know I was testing the future devtools timeline <https://github.com/scrapmac/Graphical-Timeline-of-Events> and it was listening to all GC/CC events on a GC-expensive page.

Comment 4

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: patch

Man, what a disaster. In bug 743396, I accidentally checked in the assertion that we never find black/gray edges. Either this is a very rare case to hit, or else not many people run debug builds.

Comment 5

[Andrew McCreight [:mccr8]]

Comment on attachment 636523 [details] [diff] [review]
patch

Review of attachment 636523 [details] [diff] [review]:
-----------------------------------------------------------------

Oops!

Comment 6

[Andrew McCreight [:mccr8]]

I guess it is a good sign we don't hit it that much...

Comment 7

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/394ff92cde98

Comment 8

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/394ff92cde98