"Assertion failure: callback.mFound (Cycle collection participant didn't traverse to preserved wrapper! This will probably crash.)"

RESOLVED FIXED in Firefox 42, Firefox OS master

Status

()

Core
DOM
--
critical
RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: Jesse Ruderman, Assigned: smaug)

Tracking

(Blocks: 1 bug, 4 keywords)

Trunk
mozilla42
assertion, regression, sec-high, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite -

Firefox Tracking Flags

(firefox39 unaffected, firefox40 unaffected, firefox41 unaffected, firefox42 fixed, firefox-esr31 unaffected, firefox-esr38 unaffected, b2g-v2.0 unaffected, b2g-v2.0M unaffected, b2g-v2.1 unaffected, b2g-v2.1S unaffected, b2g-v2.2 unaffected, b2g-v2.2r unaffected, b2g-master fixed)

Details

(Whiteboard: [post-critsmash-triage][b2g-adv-main2.5-])

Attachments

(3 attachments)

(Reporter)

Description

3 years ago
Created attachment 8633259 [details]
testcase

Assertion failure: callback.mFound (Cycle collection participant didn't traverse to preserved wrapper! This will probably crash.), at dom/base/nsWrapperCache.cpp:127

This must be a recent regression, since the assertion dates back to 2009:
https://hg.mozilla.org/mozilla-central/rev/5361d44863ed
(Reporter)

Updated

3 years ago
Group: core-security
(Reporter)

Comment 1

3 years ago
Created attachment 8633260 [details]
stack
Regression from bug 1177916 maybe?
Flags: needinfo?(amarchesini)
(Assignee)

Comment 3

3 years ago
Yes. Huh, I did a horrible review there.
(Assignee)

Updated

3 years ago
Blocks: 1177916
(Assignee)

Updated

3 years ago
Assignee: nobody → bugs
(Assignee)

Comment 4

3 years ago
Created attachment 8633450 [details] [diff] [review]
patch
Attachment #8633450 - Flags: review?(amarchesini)
Comment on attachment 8633450 [details] [diff] [review]
patch

Review of attachment 8633450 [details] [diff] [review]:
-----------------------------------------------------------------

I was submitting exactly the same patch.
Attachment #8633450 - Flags: review?(amarchesini) → review+
(Assignee)

Comment 6

3 years ago
FYI, I'm writing a patch for bug 1183604 to catch this kind of silly mistakes more likely.
Flags: needinfo?(amarchesini)
status-firefox41: --- → unaffected
Keywords: sec-high
https://hg.mozilla.org/mozilla-central/rev/0d2d20d51ddf
Status: NEW → RESOLVED
Last Resolved: 3 years ago
status-b2g-v2.0: --- → unaffected
status-b2g-v2.0M: --- → unaffected
status-b2g-v2.1: --- → unaffected
status-b2g-v2.1S: --- → unaffected
status-b2g-v2.2: --- → unaffected
status-b2g-v2.2r: --- → unaffected
status-b2g-master: --- → fixed
status-firefox39: --- → unaffected
status-firefox40: --- → unaffected
status-firefox42: affected → fixed
status-firefox-esr31: --- → unaffected
status-firefox-esr38: --- → unaffected
Resolution: --- → FIXED
Target Milestone: --- → mozilla42
Flags: in-testsuite?
This will eventually get tested by bug 1183604, so I don't think we need a separate test.
Flags: in-testsuite? → in-testsuite-

Updated

3 years ago
Group: core-security → core-security-release
Whiteboard: [post-critsmash-triage]
Group: core-security-release
Whiteboard: [post-critsmash-triage] → [post-critsmash-triage][b2g-adv-main2.5-]
You need to log in before you can comment on or make changes to this bug.