Closed Bug 1232891 Opened 6 years ago Closed 5 years ago

Nightly ASSERTs when exiting with top-level variable set in Browser Console

Categories

(DevTools :: Debugger, defect)

x86_64
macOS
defect
Not set
normal

Tracking

(Not tracked)

RESOLVED FIXED

People

(Reporter: djvj, Unassigned)

References

Details

Attachments

(1 file)

Attached file CRASH.txt
STR:

1. Open nightly debug build on OSX.
2. Open Browser Console.
3. Enter into command line:
  TM = {foo:33}
4. Hit enter.
5. Close browser console.
6. Exit browser with command-Q
7. Observe segfault:

Assertion failure: isEmpty(), at ../../dist/include/mozilla/LinkedList.h:328
Segmentation fault: 11

Crash report attached.
Ah, this is the same assert Eddy hit in bug 1221892, but that one was hard to reproduce locally IIRC.

NI from Eddy to make sure he's aware of this and from Terrence because this looks GC-related.
Flags: needinfo?(terrence)
Flags: needinfo?(ejpbruel)
(In reply to Jan de Mooij [:jandem] from comment #1)
> Ah, this is the same assert Eddy hit in bug 1221892, but that one was hard
> to reproduce locally IIRC.
> 
> NI from Eddy to make sure he's aware of this and from Terrence because this
> looks GC-related.

Oh, this is good news. This should go a long way towards figuring out what's causing this.

Thanks for bringing it to my attention Jan!
Flags: needinfo?(ejpbruel)
Product: Developer Documentation → Firefox
Note to self, this also needs: devtools.chrome.enabled=true
I can reproduce under OSX, but not under Linux.
If I disable UnboxedObjects entirely, this crash moves back to a similar MOZ_ASSERT for the gcWeakMapList. Breaking at WeakMap::trace during the shutdown GC, there are the normal slew of empty system weakmaps, but also some under processWeakMapTop: e.g. some JS defined WeakMaps. The one I dug through had a marked key, which caused subsequent marking under the associated value. Thus, this looks like a leak in Chrome JS. I dare say this may even be in the code I had to pref on to get here in the first place, perhaps?
Flags: needinfo?(terrence)
See Also: → 1241841
Component: Developer Tools → Developer Tools: Debugger
Depends on: 1241841
I am not able to reproduce this crash anymore, even after backing out bug 1241841.
Flags: needinfo?(kvijayan)
The new leak reporting we do during GC shutdown should allow us to easily track down any leaks that crop up in chrome code. Given that I can't reproduce it, I'm going to go ahead and close this. Feel free to re-open if it's still an issue.
Status: NEW → RESOLVED
Closed: 5 years ago
Flags: needinfo?(kvijayan)
Resolution: --- → FIXED
Product: Firefox → DevTools
You need to log in before you can comment on or make changes to this bug.