1232891 - Nightly ASSERTs when exiting with top-level variable set in Browser Console

Status: RESOLVED FIXED

(DevTools :: Debugger, defect)

Description

[Kannan Vijayan [:djvj]]

Attachment: CRASH.txt

STR:

1. Open nightly debug build on OSX.
2. Open Browser Console.
3. Enter into command line:
  TM = {foo:33}
4. Hit enter.
5. Close browser console.
6. Exit browser with command-Q
7. Observe segfault:

Assertion failure: isEmpty(), at ../../dist/include/mozilla/LinkedList.h:328
Segmentation fault: 11

Crash report attached.

Comment 1

[Jan de Mooij [:jandem]]

Ah, this is the same assert Eddy hit in bug 1221892, but that one was hard to reproduce locally IIRC.

NI from Eddy to make sure he's aware of this and from Terrence because this looks GC-related.

Comment 2

[Eddy Bruel [:ejpbruel]]

(In reply to Jan de Mooij [:jandem] from comment #1)
> Ah, this is the same assert Eddy hit in bug 1221892, but that one was hard
> to reproduce locally IIRC.
> 
> NI from Eddy to make sure he's aware of this and from Terrence because this
> looks GC-related.

Oh, this is good news. This should go a long way towards figuring out what's causing this.

Thanks for bringing it to my attention Jan!

Comment 3

[Terrence Cole [:terrence]]

Note to self, this also needs: devtools.chrome.enabled=true

Comment 4

[Terrence Cole [:terrence]]

I can reproduce under OSX, but not under Linux.

Comment 5

[Terrence Cole [:terrence]]

If I disable UnboxedObjects entirely, this crash moves back to a similar MOZ_ASSERT for the gcWeakMapList. Breaking at WeakMap::trace during the shutdown GC, there are the normal slew of empty system weakmaps, but also some under processWeakMapTop: e.g. some JS defined WeakMaps. The one I dug through had a marked key, which caused subsequent marking under the associated value. Thus, this looks like a leak in Chrome JS. I dare say this may even be in the code I had to pref on to get here in the first place, perhaps?

Comment 6

[Terrence Cole [:terrence]]

I am not able to reproduce this crash anymore, even after backing out bug 1241841.

Comment 7

[Terrence Cole [:terrence]]

The new leak reporting we do during GC shutdown should allow us to easily track down any leaks that crop up in chrome code. Given that I can't reproduce it, I'm going to go ahead and close this. Feel free to re-open if it's still an issue.