Closed
Bug 1230485
Opened 10 years ago
Closed 9 years ago
Assertion failure: !thing.asCell()->asTenured().isMarked(js::gc::GRAY), at c:/Users/mozilla/debug-builds/mozilla-central/js/src/gc/Marking.cpp:2500
Categories
(Core :: JavaScript: GC, defect)
Core
JavaScript: GC
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: cbook, Unassigned)
References
()
Details
(Keywords: assertion, sec-high)
Attachments
(1 file)
191.23 KB,
text/plain
|
Details |
Found via bughunter and reproduced on a windows 7 debug build based on tip
Load http://www.prozeny.cz/?lastId=43023
-->
Assertion failure: !thing.asCell()->asTenured().isMarked(js::gc::GRAY), at c:/Users/mozilla/debug-bu
ilds/mozilla-central/js/src/gc/Marking.cpp:2500
Updated•9 years ago
|
Group: core-security → javascript-core-security
Comment 1•9 years ago
|
||
Could you look at this, Terrence? Thanks.
I'm going to mark this sec-high but maybe it should be -critical.
Comment 2•9 years ago
|
||
I've loaded up the 2015-12-04 nightly under a fresh profile in linux under rr chaos mode. I used the console to window.open("about:blank") and in the new tab's console did |window.setInterval(function(){window.opener.location.reload()}, 10000)|. This has loaded the page hundreds of times now and I haven't gotten a crash yet. I'll let it run overnight, but I don't expect to see a crash here.
Flags: needinfo?(terrence)
Comment 3•9 years ago
|
||
The page probably changed in the interim. Carsten, can you still reproduce this? Thanks.
Flags: needinfo?(cbook)
Comment 4•9 years ago
|
||
rr crashed after 6 hours with:
[FATAL /home/terrence/moz/rr/src/AutoRemoteSyscalls.cc:374:retrieve_fd_arch() errno: 24 'Too many open files']
Updated•9 years ago
|
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → INCOMPLETE
Updated•9 years ago
|
Group: javascript-core-security
Comment 6•9 years ago
|
||
Given comment 5 maybe WORKSFORME instead?
Resolution: INCOMPLETE → WORKSFORME
You need to log in
before you can comment on or make changes to this bug.
Description
•