Closed Bug 1255223 Opened 5 years ago Closed 5 years ago

Null crash when logging weak maps

Categories

(Core :: XPCOM, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla48
Tracking Status
firefox47 --- fixed
firefox48 --- fixed

People

(Reporter: mccr8, Assigned: peterv)

References

Details

(Keywords: crash, regression)

Attachments

(1 file)

Peter hit this crash the other day, and Kris Maglione hit the same thing, so we should fix it. Peter, do you have your patch handy that adds the null check? The paste bin expired.
I think this is a regression that landed in 47 so we should uplift it.
Flags: needinfo?(peterv)
Assignee: nobody → continuation
Blocks: 1247679
Keywords: regression
This is the crash stack:

Assertion failure: asCell(), at /home/kris/code/mozilla-central/obj-debug/dist/include/js/HeapAPI.h:216
#01: JS::GCCellPtr::unsafeAsUIntPtr() const (/home/kris/code/mozilla-central/obj-debug/dist/include/js/HeapAPI.h:216 (discriminator 4))
#02: JS::GCCellPtr::unsafeAsInteger() const (/home/kris/code/mozilla-central/obj-debug/dist/include/js/HeapAPI.h:212)
#03: CCGraphBuilder::NoteWeakMapping(JSObject*, JS::GCCellPtr, JSObject*, JS::GCCellPtr) (/home/kris/code/mozilla-central/xpcom/base/nsCycleCollector.cpp:2475)
#04: non-virtual thunk to CCGraphBuilder::NoteWeakMapping(JSObject*, JS::GCCellPtr, JSObject*, JS::GCCellPtr) (/home/kris/code/mozilla-central/xpcom/base/nsCycleCollector.cpp:2463)
#05: NoteWeakMapsTracer::trace(JSObject*, JS::GCCellPtr, JS::GCCellPtr) (/home/kris/code/mozilla-central/xpcom/base/CycleCollectedJSRuntime.cpp:220)
Attached patch v1Splinter Review
Sorry, didn't have time to file this yet.
Assignee: continuation → peterv
Status: NEW → ASSIGNED
Flags: needinfo?(peterv)
Comment on attachment 8728866 [details] [diff] [review]
v1

Review of attachment 8728866 [details] [diff] [review]:
-----------------------------------------------------------------

I already had an r=mccr8 on irc, so I'll just land this.
Attachment #8728866 - Flags: review+
https://hg.mozilla.org/mozilla-central/rev/3667b972ff45
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla48
Comment on attachment 8728866 [details] [diff] [review]
v1

Approval Request Comment
[Feature/regressing bug #]: bug 1247679
[User impact if declined]: crashes when Firefox developers are debugging leaks
[Describe test coverage new/current, TreeHerder]: no test coverage
[Risks and why]: very low: this adds a null check to code that only runs when a Firefox developer is debugging a leak
[String/UUID change made/needed]: none
Attachment #8728866 - Flags: approval-mozilla-aurora?
Comment on attachment 8728866 [details] [diff] [review]
v1

Simple enough, crash fix. Aurora47+
Attachment #8728866 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.