1221897 - Assertion failure: !isEmptyShape(), at js/src/vm/Shape.h:873

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine: JIT, defect)

Description

[Bob Clary [:bc] (inactive)]

Attachment: crash report

1. https://www.expedia.com/Flights-Search?OLACID=US.BD.INTENT-MEDIA.CHECK-RATES-DOM-FLIGHT-C.FLIGHT&OLADTL=C.FLT%20:%20BWI%20:%20FLL&trip=roundtrip&leg1=from:BWI%2Cto:FLL%2Cdeparture:11/24/2015TANYT&leg2=from:FLL%2Cto:BWI%2Cdeparture:11/28/2015TANYT&passengers=children:0%2Cadults:3%2Cseniors:0%2Cinfantinlap:Y&options=sortby:price&mode=search&paandi=true

2. Assertion failure: !isEmptyShape(), at /builds/slave/m-aurora-m64-d-000000000000000/build/src/js/src/vm/Shape.h:873

Aurora/44, Nightly/45 OSX

Comment 1

[Ryan VanderMeulen [:RyanVM]]

I haven't been able to reproduce this on either Win10 or OSX 10.11.

Comment 2

[Bob Clary [:bc] (inactive)]

I retested this url and one other <http://www.manoramaonline.com/> in bughunter and could not reproduce. 

On OSX 10.8 I loaded the experia url and after changing the dates to be in the future, used Developer Web Console to open a window and to reload the url from a setInterval. After letting it run a while without an assertion, I noticed that never remember history was set for the profile which also seemed to have turned on tracking protection. When i turned history back on and restarted I got a Assertion failure: isEmpty(), at ../../dist/include/mozilla/LinkedList.h:328 which is similar to but not the same as the original. 

I repeated the manual test with remember history but could not reproduce again either.

We can either mark this WFM or leave it open and I'll keep an eye out for new reproducible cases.

Comment 3

[Jeff Walden [:Waldo]]

(In reply to Bob Clary [:bc:] from comment #2)
> When i turned history back on
> and restarted I got a Assertion failure: isEmpty(), at
> ../../dist/include/mozilla/LinkedList.h:328 which is similar to but not the
> same as the original. 

The "isEmpty" in teh assertions are entirely unrelated -- the original is a JS-engine-internal sense, the one you cite is a circular linked list that *should* have been empty when it was destroyed but was not.

Whether that means there's something useful to investigate/do here, still, I don't know, and wouldn't know without more details about this linked-list case.  The LinkedList assertion is inside a generalized data structure, so there's not enough context to make any guesses as to what its cause might be (whether JS engine or otherwise).

Comment 4

[Carsten Book [:Tomcat]]

does not crash anymore for me, bob reproducible for you still ?

Comment 5

[Bob Clary [:bc] (inactive)]

I can't reproduce with an updated url nor have we seen this assertion in the last couple of months. -> WFM