Closed Bug 1230485 Opened 10 years ago Closed 9 years ago

Assertion failure: !thing.asCell()->asTenured().isMarked(js::gc::GRAY), at c:/Users/mozilla/debug-builds/mozilla-central/js/src/gc/Marking.cpp:2500

Categories

(Core :: JavaScript: GC, defect)

defect
Not set
normal

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: cbook, Unassigned)

References

()

Details

(Keywords: assertion, sec-high)

Attachments

(1 file)

Attached file bughunter crash stack
Found via bughunter and reproduced on a windows 7 debug build based on tip Load http://www.prozeny.cz/?lastId=43023 --> Assertion failure: !thing.asCell()->asTenured().isMarked(js::gc::GRAY), at c:/Users/mozilla/debug-bu ilds/mozilla-central/js/src/gc/Marking.cpp:2500
Group: core-security → javascript-core-security
Could you look at this, Terrence? Thanks. I'm going to mark this sec-high but maybe it should be -critical.
Component: JavaScript Engine → JavaScript: GC
Flags: needinfo?(terrence)
Keywords: sec-high
I've loaded up the 2015-12-04 nightly under a fresh profile in linux under rr chaos mode. I used the console to window.open("about:blank") and in the new tab's console did |window.setInterval(function(){window.opener.location.reload()}, 10000)|. This has loaded the page hundreds of times now and I haven't gotten a crash yet. I'll let it run overnight, but I don't expect to see a crash here.
Flags: needinfo?(terrence)
The page probably changed in the interim. Carsten, can you still reproduce this? Thanks.
Flags: needinfo?(cbook)
rr crashed after 6 hours with: [FATAL /home/terrence/moz/rr/src/AutoRemoteSyscalls.cc:374:retrieve_fd_arch() errno: 24 'Too many open files']
does not crash for me anymore
Flags: needinfo?(cbook)
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → INCOMPLETE
Group: javascript-core-security
Given comment 5 maybe WORKSFORME instead?
Resolution: INCOMPLETE → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: