1233944 - crash in unsigned long js::gc::Arena::finalize<T>

Status: RESOLVED DUPLICATE of bug 1232229

(Core :: JavaScript: GC, defect)

Description

[Nils Ohlmeier [:drno]]

This bug was filed from the Socorro interface and is 
report bp-e79e6813-5373-4913-a5ac-202112151219.
=============================================================

Comment 1

[Milan Sreckovic [:milan] (needinfo for best results)]

Got it on dev edition, shortly after opening this link in a new tab: https://www.washingtonpost.com/opinions/ted-cruz-gets-burned-by-the-birther-fires-he-stoked/2016/01/08/c6cf7e02-b60a-11e5-a76a-0b5145e8679a_story.html

Comment 2

[Daniel Veditz [:dveditz]]

This has happened to me twice on nightly today. Both times was reading near the end of
http://www.nytimes.com/2016/01/19/us/rural-oregons-lost-prosperity-gives-standoff-a-distressed-backdrop.html?_r=0

(crash when reading, then crash on restore).

Comment 3

[Daniel Veditz [:dveditz]]

that link seems OK now, though, so could have been coincidence? transient sidebar content or ads?

Comment 4

[Milan Sreckovic [:milan] (needinfo for best results)]

WashingtonPost again today (https://crash-stats.mozilla.com/report/index/ca85f4bc-e946-4ba3-91b4-23ad02160126).  I think it's the "do you want to subscribe or just read the three free articles..." type of ad that floated around.

Comment 5

[Kamil Jozwiak [:kjozwiak]]

Received the same crash [1] when I was scrolling through a New York Times article [2].

[1] https://crash-stats.mozilla.com/report/index/51879192-43cd-4da8-8c03-3e7a62160128
[2] http://www.nytimes.com/2016/01/24/technology/larry-page-google-founder-is-still-innovator-in-chief.html

Comment 6

[Andrew McCreight [:mccr8]]

I also got this crash when I opened a New York Times article.

http://www.nytimes.com/2016/02/04/us/politics/jeb-bush-an-also-ran-in-iowa-may-be-pivotal-in-new-hampshire.html

Comment 7

[[e-mail]]

I just got this bug on wordpress admin screens.

Comment 8

[Milan Sreckovic [:milan] (needinfo for best results)]

Ezra, could you attach a link to the crash report?  You should be able to find it in about:crashes.

Comment 9

[[e-mail]]

Hi Milan,

Here is the crash report: https://crash-stats.mozilla.com/report/index/0765df31-694e-43ac-b594-67c592160209

I must add, that I think it was because of the wp-admin screen, but I had a lots of tabs open, so it could have been any of the others, but I was working in the wp-admin tab.

But none of the tabs was either NYT or WashingtonPost.

Comment 10

[Boris Zbarsky [:bzbarsky]]

I this twice in a row just now trying to get directions on Bing maps...

Comment 11

[Jan de Mooij [:jandem]]

Seems related to bug 1232229.

The OS X crash stack suggests the JSObject finalizer is crashing because we have an object with a nullptr group. Now, this could be random memory corruption elsewhere, but it's also possible we called setGroup with a nullptr group. There's an assert in debug builds, we could try upgrading that to a release assert...

Comment 12

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/28c3f02201e5

Comment 13

[Jan de Mooij [:jandem]]

(In reply to Jan de Mooij [:jandem] from comment #11)
> There's an assert in debug builds, we could try upgrading
> that to a release assert...

Pushed the trivial one-liner:

https://hg.mozilla.org/integration/mozilla-inbound/rev/28c3f02201e5

Comment 14

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/28c3f02201e5

Comment 15

[Robert Kaiser]

This signature has gone away on beta with the landing of bug 1232229.

Jan, does this end up being a dupe of that one?

Comment 16

[Jan de Mooij [:jandem]]

(In reply to Robert Kaiser (:[e-mail]) from comment #15)
> This signature has gone away on beta with the landing of bug 1232229.
> 
> Jan, does this end up being a dupe of that one?

Yep!

Comment 17

[Firefox Bug Husbandry Bot]

Removing leave-open keyword from resolved bugs, per :sylvestre.